Malwarebytes mehrere Funde, auch Trojaner?

Fonix · 28.07.2014, 10:52

Hallo,

Mein Opa hat mich drum gebeten, dass ich ihm seinen Laptop "säuber", weil es sich einige Viren auf dem Laptop befinden. Weil mir selber schonmal erfolgreich in diesem Forum geholfen wurde, hoffe ich das Funktioniert erneut so gut und deshalb wende ich mich jetzt an Sie!

Zum Problem:
Ich habe gestern bei ihm einen Scan mit Malwarebytes durchgeführt und einige Funde als Resultat erhalten. Unter anderem fand ich dort einen Trojaner. Ich frage mich woher diese Funde kommen, weil der Laptop sehr selten benutzt wird. Falls man das herausfinden würde, wäre das sehr toll.

Hier die angeforderten Logdateien bzw. was ich bereits gemacht habe:

-Defogger erfolgreich benutzt.

-FRST.txt

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 26-07-2014
Ran by Heinz (administrator) on HEINZ-PC on 27-07-2014 23:39:51
Running from C:\Users\Heinz\Documents\TBoard
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal

The only official download link for FRST:
Download link for 32-Bit version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/ 
Download link for 64-Bit Version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/ 
Download link from any site other than Bleeping Computer is unpermitted or outdated.
See tutorial for FRST: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(ASUSTeK Computer Inc.) C:\Windows\System32\FBAgent.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\AsLdrSrv.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(ASUS) C:\Program Files (x86)\ASUS\InstantOn for NB\InsOnSrv.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe
(McAfee, Inc.) C:\Windows\System32\mfevtps.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(McAfee, Inc.) C:\Program Files\Common Files\mcafee\systemcore\mcshield.exe
(McAfee, Inc.) C:\Program Files\Common Files\mcafee\systemcore\mfefire.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe
(ASUS) C:\Program Files (x86)\ASUS\InstantOn for NB\InsOnWMI.exe
(ASUS) C:\Program Files\ASUS\P4G\BatteryLife.exe
(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\FaceLogon\sensorsrv.exe
(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe
(ASUS) C:\Program Files (x86)\ASUS\Splendid\ACMON.exe
(ASUSTeK) C:\Windows\SysWOW64\ACEngSvr.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ATKOSD.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\KBFiltr.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\WDC.exe
(ASUS) C:\Windows\AsScrPro.exe
(Microsoft Corporation) C:\Program Files (x86)\Common Files\microsoft shared\Virtualization Handler\CVHSVC.EXE
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Alcor Micro Corp.) C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Virage Logic Corporation / Sonic Focus) C:\Program Files (x86)\ASUS\Sonic Focus\SonicFocusTray.exe
(CyberLink) C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe
(ASUS) C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avwebgrd.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Adobe Systems Incorporated) C:\Windows\System32\Macromed\Flash\FlashUtil64_14_0_0_145_ActiveX.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Program Files\Windows NT\Accessories\wordpad.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2785064 2011-05-05] (Synaptics Incorporated)
HKLM\...\Run: [AmIcoSinglun64] => C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe [361984 2011-03-21] (Alcor Micro Corp.)
HKLM\...\Run: [SynAsusAcpi] => C:\Program Files\Synaptics\SynTP\SynAsusAcpi.exe [97064 2011-05-05] (Synaptics Incorporated)
HKLM\...\Run: [RtHDVBg] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [2277480 2011-08-16] (Realtek Semiconductor)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [ASUSPRP] => C:\Program Files (x86)\ASUS\APRP\APRP.EXE [3331312 2012-02-24] (ASUSTek Computer Inc.)
HKLM-x32\...\Run: [ASUSWebStorage] => C:\Program Files (x86)\ASUS\ASUS WebStorage\3.0.108.222\AsusWSPanel.exe [737104 2011-07-29] (ecareme)
HKLM-x32\...\Run: [SonicMasterTray] => C:\Program Files (x86)\ASUS\Sonic Focus\SonicFocusTray.exe [984400 2010-07-10] (Virage Logic Corporation / Sonic Focus)
HKLM-x32\...\Run: [ATKOSD2] => C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe [318080 2011-12-23] (ASUSTek Computer Inc.)
HKLM-x32\...\Run: [ATKMEDIA] => C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe [174720 2011-10-25] (ASUS)
HKLM-x32\...\Run: [HControlUser] => C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe [105016 2009-06-19] (ASUS)
HKLM-x32\...\Run: [Wireless Console 3] => C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe [2319536 2011-10-19] (ASUS)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [750160 2014-07-05] (Avira Operations GmbH & Co. KG)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-19\...\RunOnce: [mctadmin] => C:\Windows\System32\mctadmin.exe [97280 2009-07-14] (Microsoft Corporation)
HKU\S-1-5-20\...\RunOnce: [mctadmin] => C:\Windows\System32\mctadmin.exe [97280 2009-07-14] (Microsoft Corporation)
HKU\S-1-5-21-3534363647-1427521627-2892733247-1000\...\Run: [Optimizer Pro] => C:\Program Files (x86)\Optimizer Pro\OptProLauncher.exe

-Addition.txt

Code:

ATTFilter

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 26-07-2014
Ran by Heinz at 2014-07-27 23:41:12
Running from C:\Users\Heinz\Documents\TBoard
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Avira Desktop (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AS: Avira Desktop (Enabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Adobe Flash Player 10 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 10.0.32.18 - Adobe Systems Incorporated)
Adobe Flash Player 14 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 14.0.0.145 - Adobe Systems Incorporated)
Adobe Reader X (10.1.10) MUI (HKLM-x32\...\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}) (Version: 10.1.10 - Adobe Systems Incorporated)
Alcor Micro USB Card Reader (HKLM-x32\...\AmUStor) (Version: 1.2.0117.08443 - Alcor Micro Corp.)
Alcor Micro USB Card Reader (x32 Version: 1.2.0117.08443 - Alcor Micro Corp.) Hidden
Antivirus Pro (HKLM-x32\...\Avira AntiVir Desktop) (Version: 14.0.5.464 - Avira)
Asmedia ASM104x USB 3.0 Host Controller Driver (HKLM-x32\...\{E4FB0B39-C991-4EE7-95DD-1A1A7857D33D}) (Version: 1.14.4.0 - Asmedia Technology)
ASUS AI Recovery (HKLM-x32\...\{D39F0676-163E-4595-A917-E28F99BBD4D2}) (Version: 1.0.23 - ASUS)
ASUS FaceLogon (HKLM-x32\...\{64452561-169F-4A36-A2FF-B5E118EC65F5}) (Version: 1.0.0014 - ASUS)
ASUS FancyStart (HKLM-x32\...\{C944B4C5-1C4D-4D95-8AC0-7CEF13914131}) (Version: 1.1.1 - ASUSTeK Computer Inc.)
ASUS LifeFrame3 (HKLM-x32\...\{1DBD1F12-ED93-49C0-A7CC-56CBDE488158}) (Version: 3.0.29 - ASUS)
ASUS Live Update (HKLM-x32\...\{FA540E67-095C-4A1B-97BA-4D547DEC9AF4}) (Version: 3.1.7 - ASUS)
ASUS Power4Gear Hybrid (HKLM\...\{9B6239BF-4E85-4590-8D72-51E30DB1A9AA}) (Version: 1.2.1 - ASUS)
ASUS Splendid Video Enhancement Technology (HKLM-x32\...\{0969AF05-4FF6-4C00-9406-43599238DE0D}) (Version: 1.02.0041 - ASUS)
ASUS Virtual Camera (HKLM-x32\...\{EC8BD21F-0CA0-4BBF-97D9-4A52B30041A1}) (Version: 1.0.25 - ASUS)
ASUS WebStorage (HKLM-x32\...\ASUS WebStorage) (Version: 3.0.108.222 - eCareme Technologies, Inc.)
ASUS_Screensaver (HKLM-x32\...\ASUS_Screensaver) (Version:  - )
AsusVibe2.0 (HKLM-x32\...\Asus Vibe2.0) (Version: 2.0.9.157 - ASUSTEK)
ATK Package (HKLM-x32\...\{AB5C933E-5C7D-4D30-B314-9C83A49B94BE}) (Version: 1.0.0015 - ASUS)
Buzzdock (HKLM\...\{ac225167-00fc-452d-94c5-bb93600e7d9a}) (Version:  - Alactro LLC) <==== ATTENTION
CyberLink LabelPrint (HKLM-x32\...\InstallShield_{C59C179C-668D-49A9-B6EA-0121CCFC1243}) (Version: 2.5.3624 - CyberLink Corp.)
CyberLink LabelPrint (x32 Version: 2.5.3624 - CyberLink Corp.) Hidden
CyberLink Media Suite (HKLM-x32\...\InstallShield_{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}) (Version: 8.0.2926 - CyberLink Corp.)
CyberLink Media Suite (x32 Version: 8.0.2926 - CyberLink Corp.) Hidden
CyberLink Power2Go (HKLM-x32\...\InstallShield_{40BF1E83-20EB-11D8-97C5-0009C5020658}) (Version: 7.0.0.1126 - CyberLink Corp.)
CyberLink Power2Go (x32 Version: 7.0.0.1126 - CyberLink Corp.) Hidden
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
Fast Boot (HKLM\...\{13F4A7F3-EABC-4261-AF6B-1317777F0755}) (Version: 1.0.10 - ASUS)
Galeria de Fotografias do Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Galería fotográfica de Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Galerie de photos Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Google Earth (HKLM-x32\...\{3E8A20E1-223F-11E2-9116-B8AC6F98CCE3}) (Version: 7.0.1.8244 - Google)
InstantOn for NB (HKLM-x32\...\{749F674B-2674-47E8-879C-5626A06B2A91}) (Version: 2.2.0 - ASUS)
Intel(R) Control Center (HKLM-x32\...\{F8A9085D-4C7A-41a9-8A77-C8998A96C421}) (Version: 1.2.1.1007 - Intel Corporation)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 7.0.0.1144 - Intel Corporation)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 8.15.10.2559 - Intel Corporation)
Junk Mail filter update (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Malwarebytes Anti-Malware Version 2.0.2.1012 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.2.1012 - Malwarebytes Corporation)
Mesh Runtime (x32 Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft Application Error Reporting (Version: 12.0.6015.5000 - Microsoft Corporation) Hidden
Microsoft Office 2010 (HKLM-x32\...\{95140000-0070-0000-0000-0000000FF1CE}) (Version: 14.0.4763.1000 - Microsoft Corporation)
Microsoft Office Klick-und-Los 2010 (HKLM-x32\...\Office14.Click2Run) (Version: 14.0.4763.1000 - Microsoft Corporation)
Microsoft Office Klick-und-Los 2010 (Version: 14.0.4763.1000 - Microsoft Corporation) Hidden
Microsoft Office Starter 2010 - Deutsch (HKLM-x32\...\{90140011-0066-0407-0000-0000000FF1CE}) (Version: 14.0.4763.1000 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
MSVCRT (x32 Version: 15.4.2862.0708 - Microsoft) Hidden
MSVCRT_amd64 (x32 Version: 15.4.2862.0708 - Microsoft) Hidden
OpenOffice 4.0.1 (HKLM-x32\...\{0AEC308E-7EB3-47F7-BB59-F2C9C6166B27}) (Version: 4.01.9714 - Apache Software Foundation)
Optimizer Pro v3.1 (HKLM-x32\...\Optimizer Pro_is1) (Version: 3.1 - PC Utilities Pro) <==== ATTENTION
Raccolta foto di Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Ralink RT2860 Wireless LAN Card (HKLM-x32\...\{8FC4F1DD-F7FD-4766-804D-3C8FF1D309B0}) (Version: 1.2.0.40 - Ralink)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6454 - Realtek Semiconductor Corp.)
Sonic Focus (HKLM-x32\...\{09BCB9CE-964B-4BDA-AE46-B5A0ABEF1D3F}) (Version: 1.0.0.4 - Synopsys )
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 15.3.6.0 - Synaptics Incorporated)
WebConnect 3.0.0 (HKLM\...\WebConnect) (Version: 3.0.0 - Web Connect) <==== ATTENTION
Windows Live Communications Platform (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 15.4.3538.0513 - Microsoft Corporation)
Windows Live Essentials (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Family Safety (Version: 15.4.3538.0513 - Microsoft Corporation) Hidden
Windows Live Fotogalerie (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live ID Sign-in Assistant (Version: 7.250.4232.0 - Microsoft Corporation) Hidden
Windows Live Installer (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Language Selector (Version: 15.4.3538.0513 - Microsoft Corporation) Hidden
Windows Live Mail (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Mesh - ActiveX-besturingselement voor externe verbindingen (HKLM-x32\...\{C32CE55C-12BA-4951-8797-0967FDEF556F}) (Version: 15.4.5722.2 - Microsoft Corporation)
Windows Live Mesh (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Mesh ActiveX Control for Remote Connections (HKLM-x32\...\{2902F983-B4C1-44BA-B85D-5C6D52E2C441}) (Version: 15.4.5722.2 - Microsoft Corporation)
Windows Live Mesh ActiveX control for remote connections (HKLM-x32\...\{C5398A89-516C-4DAF-BA07-EE7949090E56}) (Version: 15.4.5722.2 - Microsoft Corporation)
Windows Live Mesh ActiveX Control for Remote Connections (HKLM-x32\...\{C63A1E60-B6A4-440B-89A5-1FC6E4AC1C94}) (Version: 15.4.5722.2 - Microsoft Corporation)
Windows Live Messenger (x32 Version: 15.4.3538.0513 - Microsoft Corporation) Hidden
Windows Live Messenger (x32 Version: 15.4.3538.0513 - Корпорация Майкрософт) Hidden
Windows Live MIME IFilter (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Movie Maker (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Photo Common (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Photo Gallery (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live PIMT Platform (x32 Version: 15.4.3508.1109 - Microsoft Corporation) Hidden
Windows Live Remote Client (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Client Resources (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Service (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Service Resources (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live SOXE (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live SOXE Definitions (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live UX Platform (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live UX Platform Language Pack (x32 Version: 15.4.3508.1109 - Microsoft Corporation) Hidden
Windows Live Writer (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Writer Resources (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live 影像中心 (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live 程式集 (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
WinFlash (HKLM-x32\...\{8F21291E-0444-4B1D-B9F9-4370A73E346D}) (Version: 2.41.0 - ASUS)
Wireless Console 3 (HKLM-x32\...\{19EA33FB-B34E-40EA-8B8A-61743AEB795A}) (Version: 3.0.25 - ASUS)
Συλλογή φωτογραφιών του Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Основные компоненты Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Почта Windows Live (x32 Version: 15.4.3502.0922 - Корпорация Майкрософт) Hidden
Фотоальбом Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
גלריית התמונות של Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
بريد Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
معرض صور Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)


==================== Restore Points  =========================

08-06-2014 15:28:50 Windows Update
23-06-2014 14:11:00 Windows Update
23-06-2014 14:59:03 Windows Update
05-07-2014 14:21:46 Windows Update
14-07-2014 13:12:49 Windows Update
14-07-2014 13:40:23 Windows Update
24-07-2014 13:40:18 Windows Update
25-07-2014 15:22:19 Windows Update

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {38ED05BA-3EC5-4A46-9D24-1136CEF7D1DB} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-07-10] (Adobe Systems Incorporated)
Task: {5F750EB9-6F2A-4A46-8727-0B04B4A5F836} - System32\Tasks\Yahoo! Search => C:\Users\Heinz\AppData\Local\Pay-By-Ads\Yahoo! Search\1.3.8.2\dsrlte.exe
Task: {60120C5B-6A6F-42AF-A5CC-CF3AC0BABDD0} - System32\Tasks\ASUS SmartLogon Console Sensor => C:\Program Files (x86)\ASUS\FaceLogon\sensorsrv.exe [2012-02-17] (ASUSTek Computer Inc.)
Task: {64BCBE8C-7407-4175-8880-F43129DE8B32} - System32\Tasks\0 => Iexplore.exe 
Task: {75DF127D-ABB3-4375-9FC2-5B08A3D33AED} - System32\Tasks\{78A5DB1D-D5E8-4F2E-A2BC-620A7A5CABE8} => Iexplore.exe hxxp://www.skype.com/go/downloading?source=lightinstaller&amp;ver=5.10.0.114&amp;LastError=404
Task: {C0B182D8-4607-4594-859C-7DAA3A3BF934} - System32\Tasks\Omiga Plus RunAsStdUser => C:\Program Files (x86)\Omiga Plus\omigaplus.exe
Task: {D0D3DFDD-7DFF-4380-8B34-1A5014B9E3EC} - System32\Tasks\4691 => Wscript.exe C:\Users\Heinz\AppData\Local\Temp\launchie.vbs //B
Task: {DC3D9167-B5B6-4702-8EB8-D7602252EA4D} - System32\Tasks\ASUS P4G => C:\Program Files\ASUS\P4G\BatteryLife.exe [2012-02-16] (ASUS)
Task: {DDA2C99F-454A-4912-B1F9-D8D3798430E7} - System32\Tasks\ATKOSD2 => C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe [2011-12-23] (ASUSTek Computer Inc.)
Task: {DDF537AA-0A71-4D6C-B9F4-71BA8079A51C} - System32\Tasks\Desk 365 RunAsStdUser => C:\Program Files (x86)\Desk 365\desk365.exe <==== ATTENTION
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

==================== Loaded Modules (whitelisted) =============

2010-07-15 01:11 - 2010-07-15 01:11 - 00031360 _____ () C:\Program Files\ASUS\P4G\DevMng.dll
2012-03-05 03:24 - 2011-05-05 14:30 - 00057640 _____ () C:\Program Files\Synaptics\SynTP\SynTPEnhPS.dll
2012-02-21 23:49 - 2012-02-21 23:49 - 00009216 _____ () C:\Program Files (x86)\ASUS\Splendid\GLCDdll.dll
2010-08-20 18:57 - 2010-08-20 18:57 - 00619816 _____ () C:\Program Files (x86)\CyberLink\Power2Go\CLMediaLibrary.dll
2010-08-20 18:57 - 2010-08-20 18:57 - 00013096 _____ () C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvcPS.dll
2007-07-12 20:11 - 2007-07-12 20:11 - 01163264 _____ () C:\Program Files (x86)\ASUS\Wireless Console 3\acAuth.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)

AlternateDataStreams: C:\ProgramData\Temp:373E1720

==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfefire => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfefirek => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfefirek.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfehidk => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfehidk.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfevtp => ""="Driver"

==================== EXE Association (whitelisted) =============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== MSCONFIG/TASK MANAGER disabled items =========

(Currently there is no automatic fix for this section.)

MSCONFIG\startupreg: ACMON => C:\Program Files (x86)\ASUS\Splendid\ACMON.exe
MSCONFIG\startupreg: Adobe Reader Speed Launcher => "C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe"
MSCONFIG\startupreg: ASUS Screen Saver Protector => C:\Windows\AsScrPro.exe
MSCONFIG\startupreg: CLMLServer => "C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe"
MSCONFIG\startupreg: RtHDVCpl => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe -s

==================== Faulty Device Manager Devices =============

Name: Teredo Tunneling Pseudo-Interface
Description: Microsoft-Teredo-Tunneling-Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device cannot start. (Code10)
Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.


==================== Event log errors: =========================

Application errors:
==================
Error: (07/27/2014 06:43:49 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: dsrlte.exe, Version: 1.1.0.2, Zeitstempel: 0x53996de6
Name des fehlerhaften Moduls: ole32.dll, Version: 6.1.7601.17514, Zeitstempel: 0x4ce7b96f
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0003bc24
ID des fehlerhaften Prozesses: 0x1458
Startzeit der fehlerhaften Anwendung: 0xdsrlte.exe0
Pfad der fehlerhaften Anwendung: dsrlte.exe1
Pfad des fehlerhaften Moduls: dsrlte.exe2
Berichtskennung: dsrlte.exe3

Error: (07/27/2014 06:13:51 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm mbam.exe, Version 1.0.0.532 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: 954

Startzeit: 01cfa9af9911ceda

Endzeit: 15

Anwendungspfad: C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe

Berichts-ID: fc05158e-15a8-11e4-b4ac-10bf4824462e

Error: (07/25/2014 05:23:04 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm IEXPLORE.EXE, Version 11.0.9600.17207 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: 320

Startzeit: 01cfa81bd5569c9d

Endzeit: 0

Anwendungspfad: C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

Berichts-ID:

Error: (07/24/2014 04:17:46 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm mbam.exe, Version 1.0.0.532 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: 1420

Startzeit: 01cfa749d4a1badc

Endzeit: 16

Anwendungspfad: C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe

Berichts-ID: 39c23468-133d-11e4-901a-10bf4824462e

Error: (07/24/2014 04:14:35 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm IEXPLORE.EXE, Version 11.0.9600.17207 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: 2450

Startzeit: 01cfa74977eff3a4

Endzeit: 0

Anwendungspfad: C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

Berichts-ID:

Error: (06/08/2014 05:50:37 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: googleearth.exe, Version: 7.0.1.8244, Zeitstempel: 0x508f4296
Name des fehlerhaften Moduls: googleearth_free.dll, Version: 0.0.0.0, Zeitstempel: 0x508f4277
Ausnahmecode: 0xc0000005
Fehleroffset: 0x001b5833
ID des fehlerhaften Prozesses: 0x20cc
Startzeit der fehlerhaften Anwendung: 0xgoogleearth.exe0
Pfad der fehlerhaften Anwendung: googleearth.exe1
Pfad des fehlerhaften Moduls: googleearth.exe2
Berichtskennung: googleearth.exe3

Error: (06/01/2014 04:21:24 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm googleearth.exe, Version 7.0.1.8244 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: 1158

Startzeit: 01cf7da4a0926fd6

Endzeit: 17

Anwendungspfad: C:\Program Files (x86)\Google\Google Earth\client\googleearth.exe

Berichts-ID: fee475f5-e997-11e3-a4bc-10bf4824462e


System errors:
=============
Error: (07/27/2014 07:07:18 PM) (Source: bowser) (EventID: 8003) (User: )
Description: Der Hauptsuchdienst erhielt eine Serverankündigung vom Computer "EASYBOX",
der der Hauptsuchdienst der Domäne für den NetBT_Tcpip_{DA256DB6-B2D7-4D4C-B550-94AEF01780A0}-Transport zu sein scheint.
Der Hauptsuchdienst wurde beendet oder es wird eine Auswahl erzwungen.

Error: (07/27/2014 06:50:49 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "Software Updater" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.

Error: (07/27/2014 06:23:07 PM) (Source: Service Control Manager) (EventID: 7022) (User: )
Description: Der Dienst "Windows Update" wurde nicht richtig gestartet.

Error: (07/27/2014 06:19:14 PM) (Source: bowser) (EventID: 8003) (User: )
Description: Der Hauptsuchdienst erhielt eine Serverankündigung vom Computer "EASYBOX",
der der Hauptsuchdienst der Domäne für den NetBT_Tcpip_{DA256DB6-B2D7-4D4C-B550-94AEF01780A0}-Transport zu sein scheint.
Der Hauptsuchdienst wurde beendet oder es wird eine Auswahl erzwungen.

Error: (07/27/2014 05:28:48 PM) (Source: bowser) (EventID: 8003) (User: )
Description: Der Hauptsuchdienst erhielt eine Serverankündigung vom Computer "EASYBOX",
der der Hauptsuchdienst der Domäne für den NetBT_Tcpip_{DA256DB6-B2D7-4D4C-B550-94AEF01780A0}-Transport zu sein scheint.
Der Hauptsuchdienst wurde beendet oder es wird eine Auswahl erzwungen.

Error: (07/27/2014 05:25:48 PM) (Source: bowser) (EventID: 8003) (User: )
Description: Der Hauptsuchdienst erhielt eine Serverankündigung vom Computer "EASYBOX",
der der Hauptsuchdienst der Domäne für den NetBT_Tcpip_{DA256DB6-B2D7-4D4C-B550-94AEF01780A0}-Transport zu sein scheint.
Der Hauptsuchdienst wurde beendet oder es wird eine Auswahl erzwungen.

Error: (07/27/2014 03:19:35 PM) (Source: bowser) (EventID: 8003) (User: )
Description: Der Hauptsuchdienst erhielt eine Serverankündigung vom Computer "EASYBOX",
der der Hauptsuchdienst der Domäne für den NetBT_Tcpip_{DA256DB6-B2D7-4D4C-B550-94AEF01780A0}-Transport zu sein scheint.
Der Hauptsuchdienst wurde beendet oder es wird eine Auswahl erzwungen.

Error: (07/26/2014 04:53:17 PM) (Source: bowser) (EventID: 8003) (User: )
Description: Der Hauptsuchdienst erhielt eine Serverankündigung vom Computer "EASYBOX",
der der Hauptsuchdienst der Domäne für den NetBT_Tcpip_{DA256DB6-B2D7-4D4C-B550-94AEF01780A0}-Transport zu sein scheint.
Der Hauptsuchdienst wurde beendet oder es wird eine Auswahl erzwungen.

Error: (07/26/2014 04:17:13 PM) (Source: bowser) (EventID: 8003) (User: )
Description: Der Hauptsuchdienst erhielt eine Serverankündigung vom Computer "EASYBOX",
der der Hauptsuchdienst der Domäne für den NetBT_Tcpip_{DA256DB6-B2D7-4D4C-B550-94AEF01780A0}-Transport zu sein scheint.
Der Hauptsuchdienst wurde beendet oder es wird eine Auswahl erzwungen.

Error: (07/26/2014 04:05:12 PM) (Source: bowser) (EventID: 8003) (User: )
Description: Der Hauptsuchdienst erhielt eine Serverankündigung vom Computer "EASYBOX",
der der Hauptsuchdienst der Domäne für den NetBT_Tcpip_{DA256DB6-B2D7-4D4C-B550-94AEF01780A0}-Transport zu sein scheint.
Der Hauptsuchdienst wurde beendet oder es wird eine Auswahl erzwungen.


Microsoft Office Sessions:
=========================
Error: (07/27/2014 06:43:49 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: dsrlte.exe1.1.0.253996de6ole32.dll6.1.7601.175144ce7b96fc00000050003bc24145801cfa9b66445ffa4C:\Users\Heinz\AppData\Local\Pay-By-Ads\Yahoo! Search\1.3.8.2\dsrlte.exeC:\Windows\syswow64\ole32.dll2eb6b9c8-15ad-11e4-b1b4-10bf4824462e

Error: (07/27/2014 06:13:51 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: mbam.exe1.0.0.53295401cfa9af9911ceda15C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exefc05158e-15a8-11e4-b4ac-10bf4824462e

Error: (07/25/2014 05:23:04 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: IEXPLORE.EXE11.0.9600.1720732001cfa81bd5569c9d0C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

Error: (07/24/2014 04:17:46 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: mbam.exe1.0.0.532142001cfa749d4a1badc16C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe39c23468-133d-11e4-901a-10bf4824462e

Error: (07/24/2014 04:14:35 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: IEXPLORE.EXE11.0.9600.17207245001cfa74977eff3a40C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

Error: (06/08/2014 05:50:37 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: googleearth.exe7.0.1.8244508f4296googleearth_free.dll0.0.0.0508f4277c0000005001b583320cc01cf83314375ee4bC:\Program Files (x86)\Google\Google Earth\client\googleearth.exeC:\Program Files (x86)\Google\Google Earth\client\googleearth_free.dlla2266745-ef24-11e3-bb13-10bf4824462e

Error: (06/01/2014 04:21:24 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: googleearth.exe7.0.1.8244115801cf7da4a0926fd617C:\Program Files (x86)\Google\Google Earth\client\googleearth.exefee475f5-e997-11e3-a4bc-10bf4824462e


==================== Memory info =========================== 

Percentage of memory in use: 29%
Total physical RAM: 6048.13 MB
Available physical RAM: 4293.53 MB
Total Pagefile: 12094.43 MB
Available Pagefile: 10011.46 MB
Total Virtual: 8192 MB
Available Virtual: 8191.84 MB

==================== Drives ================================

Drive c: (PC) (Fixed) (Total:186.3 GB) (Free:134.84 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive d: (Heinz) (Fixed) (Total:254.46 GB) (Free:254.36 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 466 GB) (Disk ID: E3102A4B)
Partition 1: (Not Active) - (Size=25 GB) - (Type=1C)
Partition 2: (Active) - (Size=186 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=254 GB) - (Type=07 NTFS)

==================== End Of Log ============================

-Gmer.txt

Code:

ATTFilter

GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2014-07-28 00:07:30
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 Hitachi_ rev.JE3O 465,76GB
Running: ps8n547p.exe; Driver: C:\Users\Heinz\AppData\Local\Temp\kwloipog.sys


---- User code sections - GMER 2.1 ----

.text   C:\Windows\AsScrPro.exe[3664] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                                                  0000000076211465 2 bytes [21, 76]
.text   C:\Windows\AsScrPro.exe[3664] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                                                 00000000762114bb 2 bytes [21, 76]
.text   ...                                                                                                                                                    * 2
.text   C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[3676] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69   0000000076211465 2 bytes [21, 76]
.text   C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[3676] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155  00000000762114bb 2 bytes [21, 76]
.text   ...                                                                                                                                                    * 2

---- User IAT/EAT - GMER 2.1 ----

IAT     C:\Windows\system32\mfevtps.exe[1632] @ C:\Windows\system32\CRYPT32.dll[KERNEL32.dll!LoadLibraryA]                                                     [13ff0c0c0] C:\Windows\system32\mfevtps.exe

---- Threads - GMER 2.1 ----

Thread  C:\Windows\System32\svchost.exe [2164:3108]                                                                                                            000007fef1f39688

---- Registry - GMER 2.1 ----

Reg     HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\0025d3b2962e                                                                            
Reg     HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\0025d3b2962e (not active ControlSet)                                                        

---- EOF - GMER 2.1 ----

-MBAM Logfile: (Ich glaube hier habe ich einen Fehler gemacht, aber ich weiß nicht wie ich die Logs anders posten kann. Tut mir Leid. Falls Sie mir sagen können, wie ich den Log besser posten kann, poste ich ihn gerne erneut)

Code:

ATTFilter

<?xml version="1.0" encoding="UTF-16" ?>
<mbam-log>
<header>
<date>2014/07/27 18:18:55 +0200</date>
<logfile>mbam-log-2014-07-27 (18-18-53).xml</logfile>
<isadmin>yes</isadmin>
</header>
<engine>
<version>2.00.2.1012</version>
<malware-database>v2014.07.27.05</malware-database>
<rootkit-database>v2014.07.17.01</rootkit-database>
<license>free</license>
<file-protection>disabled</file-protection>
<web-protection>disabled</web-protection>
<self-protection>disabled</self-protection>
</engine>
<system>
<osversion>Windows 7 Service Pack 1</osversion>
<arch>x64</arch>
<username>Heinz</username>
<filesys>NTFS</filesys>
</system>
<summary>
<type>threat</type>
<result>completed</result>
<objects>289489</objects>
<time>1834</time>
<processes>4</processes>
<modules>1</modules>
<keys>52</keys>
<values>6</values>
<datas>0</datas>
<folders>40</folders>
<files>172</files>
<sectors>0</sectors>
</summary>
<options>
<memory>enabled</memory>
<startup>enabled</startup>
<filesystem>enabled</filesystem>
<archives>enabled</archives>
<rootkits>disabled</rootkits>
<deeprootkit>disabled</deeprootkit>
<heuristics>enabled</heuristics>
<pup>enabled</pup>
<pum>enabled</pum>
</options>
<items>
<process><path>C:\Program Files (x86)\SoftwareUpdater\UpdaterService.exe</path><vendor>PUP.Optional.SoftwareUpdater.A</vendor><action>delete-on-reboot</action><pid>2952</pid><hash>f38e594b4a31ca6c4df127f00bf63cc4</hash></process>
<process><path>C:\Program Files (x86)\WebConnect\updateWebConnect.exe</path><vendor>PUP.Optional.WebConnect.A</vendor><action>delete-on-reboot</action><pid>2320</pid><hash>9ce5aff52259fc3a28d51449f30e6898</hash></process>
<process><path>C:\Program Files (x86)\WebConnect\bin\utilWebConnect.exe</path><vendor>PUP.Optional.WebConnect.A</vendor><action>delete-on-reboot</action><pid>3904</pid><hash>2958604496e53105708daab319e8ae52</hash></process>
<process><path>C:\Users\Heinz\AppData\Local\Pay-By-Ads\Yahoo! Search\1.3.8.2\dsrlte.exe</path><vendor>PUP.Optional.PayByAds.A</vendor><action>delete-on-reboot</action><pid>5208</pid><hash>4b365e46e19a26105b46ce1629dbd22e</hash></process>
<module><path>C:\Users\Heinz\AppData\Local\Pay-By-Ads\Yahoo! Search\1.3.8.2\sqlite.dll</path><vendor>PUP.Optional.PayByAds.A</vendor><action>delete-on-reboot</action><hash>f48dcdd766154beb27c2cdf319e9c33d</hash></module>
<key><path>HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\SRVUPDATER</path><vendor>PUP.Optional.SoftwareUpdater.A</vendor><action>success</action><hash>f38e594b4a31ca6c4df127f00bf63cc4</hash></key>
<key><path>HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\Update WebConnect</path><vendor>PUP.Optional.WebConnect.A</vendor><action>success</action><hash>9ce5aff52259fc3a28d51449f30e6898</hash></key>
<key><path>HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\Util WebConnect</path><vendor>PUP.Optional.WebConnect.A</vendor><action>success</action><hash>2958604496e53105708daab319e8ae52</hash></key>
<key><path>HKU\S-1-5-21-3534363647-1427521627-2892733247-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\Yahoo! Search</path><vendor>PUP.Optional.PayByAds.A</vendor><action>success</action><hash>4b365e46e19a26105b46ce1629dbd22e</hash></key>
<key><path>HKLM\SOFTWARE\CLASSES\APPID\{38A066B0-DD5F-4226-AC4F-6A27C1BFB892}</path><vendor>PUP.Optional.PricePeep.A</vendor><action>success</action><hash>b8c9990b0b707db9020e593d32d0f808</hash></key>
<key><path>HKLM\SOFTWARE\WOW6432NODE\CLASSES\APPID\{38A066B0-DD5F-4226-AC4F-6A27C1BFB892}</path><vendor>PUP.Optional.PricePeep.A</vendor><action>success</action><hash>b8c9990b0b707db9020e593d32d0f808</hash></key>
<key><path>HKLM\SOFTWARE\CLASSES\APPID\{C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3}</path><vendor>PUP.Optional.Delta.A</vendor><action>success</action><hash>e59c3c68c0bbb2846538b9dce61ce61a</hash></key>
<key><path>HKLM\SOFTWARE\WOW6432NODE\CLASSES\APPID\{C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3}</path><vendor>PUP.Optional.Delta.A</vendor><action>success</action><hash>e59c3c68c0bbb2846538b9dce61ce61a</hash></key>
<key><path>HKLM\SOFTWARE\CLASSES\CLSID\{4AA46D49-459F-4358-B4D1-169048547C23}</path><vendor>PUP.Optional.BrowseFox.A</vendor><action>success</action><hash>d6ab7e2683f8ab8bf4c95a3bc83a43bd</hash></key>
<key><path>HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{4AA46D49-459F-4358-B4D1-169048547C23}</path><vendor>PUP.Optional.BrowseFox.A</vendor><action>success</action><hash>d6ab7e2683f8ab8bf4c95a3bc83a43bd</hash></key>
<key><path>HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{DF84E609-C3A4-49CB-A160-61767DAF8899}</path><vendor>PUP.Optional.WebCake.A</vendor><action>success</action><hash>572aabf94c2f90a64f525f3618ea24dc</hash></key>
<key><path>HKLM\SOFTWARE\WOW6432NODE\CLASSES\INTERFACE\{DF84E609-C3A4-49CB-A160-61767DAF8899}</path><vendor>PUP.Optional.WebCake.A</vendor><action>success</action><hash>572aabf94c2f90a64f525f3618ea24dc</hash></key>
<key><path>HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{FD6D90C0-E6EE-4BC6-B9F7-9ED319698007}</path><vendor>PUP.Optional.PricePeep.A</vendor><action>success</action><hash>3d44ced6f58644f2f9f34f452bd7fa06</hash></key>
<key><path>HKLM\SOFTWARE\CLASSES\TYPELIB\{3BF3DED5-0FC8-4207-AC09-AA7B5AF4E408}</path><vendor>PUP.Optional.PricePeep.A</vendor><action>success</action><hash>3d44ced6f58644f2f9f34f452bd7fa06</hash></key>
<key><path>HKLM\SOFTWARE\CLASSES\INTERFACE\{1B97A696-5576-43AC-A73B-E1D2C78F21E8}</path><vendor>PUP.Optional.PricePeep.A</vendor><action>success</action><hash>3d44ced6f58644f2f9f34f452bd7fa06</hash></key>
<key><path>HKLM\SOFTWARE\CLASSES\INTERFACE\{75BF416E-4326-45B5-8A2D-AE32D05B930B}</path><vendor>PUP.Optional.PricePeep.A</vendor><action>success</action><hash>3d44ced6f58644f2f9f34f452bd7fa06</hash></key>
<key><path>HKLM\SOFTWARE\WOW6432NODE\CLASSES\INTERFACE\{1B97A696-5576-43AC-A73B-E1D2C78F21E8}</path><vendor>PUP.Optional.PricePeep.A</vendor><action>success</action><hash>3d44ced6f58644f2f9f34f452bd7fa06</hash></key>
<key><path>HKLM\SOFTWARE\WOW6432NODE\CLASSES\INTERFACE\{75BF416E-4326-45B5-8A2D-AE32D05B930B}</path><vendor>PUP.Optional.PricePeep.A</vendor><action>success</action><hash>3d44ced6f58644f2f9f34f452bd7fa06</hash></key>
<key><path>HKLM\SOFTWARE\WOW6432NODE\CLASSES\TYPELIB\{3BF3DED5-0FC8-4207-AC09-AA7B5AF4E408}</path><vendor>PUP.Optional.PricePeep.A</vendor><action>success</action><hash>3d44ced6f58644f2f9f34f452bd7fa06</hash></key>
<key><path>HKLM\SOFTWARE\CLASSES\PricePeep.PricePeepBho.1</path><vendor>PUP.Optional.PricePeep.A</vendor><action>success</action><hash>3d44ced6f58644f2f9f34f452bd7fa06</hash></key>
<key><path>HKLM\SOFTWARE\CLASSES\PricePeep.PricePeepBho</path><vendor>PUP.Optional.PricePeep.A</vendor><action>success</action><hash>3d44ced6f58644f2f9f34f452bd7fa06</hash></key>
<key><path>HKLM\SOFTWARE\WOW6432NODE\CLASSES\PricePeep.PricePeepBho</path><vendor>PUP.Optional.PricePeep.A</vendor><action>success</action><hash>3d44ced6f58644f2f9f34f452bd7fa06</hash></key>
<key><path>HKLM\SOFTWARE\WOW6432NODE\CLASSES\PricePeep.PricePeepBho.1</path><vendor>PUP.Optional.PricePeep.A</vendor><action>success</action><hash>3d44ced6f58644f2f9f34f452bd7fa06</hash></key>
<key><path>HKLM\SOFTWARE\CLASSES\TYPELIB\{3BF3DED5-0FC8-4207-AC09-AA7B5AF4E408}</path><vendor>Adware.Agent</vendor><action>success</action><hash>afd203a1f289c175206f54100ef4b54b</hash></key>
<key><path>HKLM\SOFTWARE\CLASSES\INTERFACE\{1B97A696-5576-43AC-A73B-E1D2C78F21E8}</path><vendor>Adware.Agent</vendor><action>success</action><hash>afd203a1f289c175206f54100ef4b54b</hash></key>
<key><path>HKLM\SOFTWARE\CLASSES\INTERFACE\{75BF416E-4326-45B5-8A2D-AE32D05B930B}</path><vendor>Adware.Agent</vendor><action>success</action><hash>afd203a1f289c175206f54100ef4b54b</hash></key>
<key><path>HKLM\SOFTWARE\WOW6432NODE\CLASSES\INTERFACE\{1B97A696-5576-43AC-A73B-E1D2C78F21E8}</path><vendor>Adware.Agent</vendor><action>success</action><hash>afd203a1f289c175206f54100ef4b54b</hash></key>
<key><path>HKLM\SOFTWARE\WOW6432NODE\CLASSES\INTERFACE\{75BF416E-4326-45B5-8A2D-AE32D05B930B}</path><vendor>Adware.Agent</vendor><action>success</action><hash>afd203a1f289c175206f54100ef4b54b</hash></key>
<key><path>HKLM\SOFTWARE\WOW6432NODE\CLASSES\TYPELIB\{3BF3DED5-0FC8-4207-AC09-AA7B5AF4E408}</path><vendor>Adware.Agent</vendor><action>success</action><hash>afd203a1f289c175206f54100ef4b54b</hash></key>
<key><path>HKU\S-1-5-21-3534363647-1427521627-2892733247-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}</path><vendor>PUP.Optional.Babylon.A</vendor><action>success</action><hash>31505d47d5a6c0769e8cf46829d9c33d</hash></key>
<key><path>HKU\S-1-5-21-3534363647-1427521627-2892733247-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{AF6B0594-6008-4327-93E5-608AD710A6FA}</path><vendor>PUP.Optional.WebCake.A</vendor><action>success</action><hash>c2bf3a6ae299aa8c821e375e46bc5da3</hash></key>
<key><path>HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY\{68B81CCD-A80C-4060-8947-5AE69ED01199}</path><vendor>PUP.Optional.Iminent.A</vendor><action>success</action><hash>a1e0376d8dee94a252917223768cf40c</hash></key>
<key><path>HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY\{E6B969FB-6D33-48d2-9061-8BBD4899EB08}</path><vendor>PUP.Optional.Iminent.A</vendor><action>success</action><hash>c5bc9d070f6cdf57667ed6bf986a748c</hash></key>
<key><path>HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\SoftwareUpdater</path><vendor>PUP.Optional.SoftwareUpdater.A</vendor><action>success</action><hash>a8d9d0d4611a4ee8eb81848422e203fd</hash></key>
<key><path>HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\{664f7cae-01d9-48b5-bc90-e3c3d6bb0ddb}w64</path><vendor>PUP.Optional.Sanbreel.A</vendor><action>success</action><hash>a7da4c58dd9ee84e0df69893de269d63</hash></key>
<key><path>HKLM\SOFTWARE\DomaIQ</path><vendor>PUP.Optional.DomaIQ.A</vendor><action>success</action><hash>d2afc0e44b3050e6d21b985fba4836ca</hash></key>
<key><path>HKLM\SOFTWARE\CLASSES\APPID\PricePeep.DLL</path><vendor>PUP.Optional.PricePeep.A</vendor><action>success</action><hash>661b6b393c3f76c0267d9379000427d9</hash></key>
<key><path>HKLM\SOFTWARE\WOW6432NODE\DataMngr</path><vendor>PUP.Optional.DataMangr.A</vendor><action>success</action><hash>93ee059f403b7eb83fdd4197b64c13ed</hash></key>
<key><path>HKLM\SOFTWARE\WOW6432NODE\Iminent</path><vendor>PUP.Optional.Iminent.A</vendor><action>success</action><hash>a3de4d57502b013503edb14460a20af6</hash></key>
<key><path>HKLM\SOFTWARE\WOW6432NODE\CLASSES\APPID\PricePeep.DLL</path><vendor>PUP.Optional.PricePeep.A</vendor><action>success</action><hash>d4addfc54c2fdd59b8eb78942ada13ed</hash></key>
<key><path>HKLM\SOFTWARE\WOW6432NODE\SOFTWAREUPDATER</path><vendor>PUP.Optional.SoftwareUpdater.A</vendor><action>success</action><hash>60217d275724ce68a1cd40cc699ba65a</hash></key>
<key><path>HKLM\SOFTWARE\WOW6432NODE\VITTALIA\AxtanInstaller</path><vendor>PUP.Optional.BundleInstaller.A</vendor><action>success</action><hash>f889baead2a9ba7c64255f932fd3bf41</hash></key>
<key><path>HKU\S-1-5-21-3534363647-1427521627-2892733247-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\DataMngr</path><vendor>PUP.Optional.DataMngr.A</vendor><action>success</action><hash>067bb4f0473455e1955daa60a064a15f</hash></key>
<key><path>HKU\S-1-5-21-3534363647-1427521627-2892733247-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\DataMngr_Toolbar</path><vendor>PUP.Optional.DataMngr.A</vendor><action>success</action><hash>2c55a2020a71e650faf752b8996b728e</hash></key>
<key><path>HKU\S-1-5-21-3534363647-1427521627-2892733247-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\Iminent</path><vendor>PUP.Optional.Iminent.A</vendor><action>success</action><hash>abd6772d87f49b9b0ae7dc1917eb926e</hash></key>
<key><path>HKU\S-1-5-21-3534363647-1427521627-2892733247-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\BABSOLUTION\Redir</path><vendor>PUP.Optional.Babylon.A</vendor><action>success</action><hash>671a22820e6da98d8b69f318f1136b95</hash></key>
<key><path>HKU\S-1-5-21-3534363647-1427521627-2892733247-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\BABSOLUTION\Updater</path><vendor>PUP.Optional.Babylon.A</vendor><action>success</action><hash>225fedb73d3e3df90bea12f9689c6c94</hash></key>
<key><path>HKU\S-1-5-21-3534363647-1427521627-2892733247-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\INSTALLCORE\1I1T1Q1S</path><vendor>PUP.Optional.InstallCore.A</vendor><action>success</action><hash>abd6dfc5c2b9f2440bf047ad7989936d</hash></key>
<key><path>HKU\S-1-5-21-3534363647-1427521627-2892733247-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\INSTALLCORE</path><vendor>PUP.Optional.InstallCore.A</vendor><action>success</action><hash>cdb4e8bcb6c578bedf369a71a163bd43</hash></key>
<key><path>HKU\S-1-5-21-3534363647-1427521627-2892733247-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\DOMSTORAGE\superfish.com</path><vendor>PUP.Optional.SuperFish.A</vendor><action>success</action><hash>9fe23b691b607db91719626fe121bb45</hash></key>
<key><path>HKU\S-1-5-21-3534363647-1427521627-2892733247-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\SOFTONIC\Universal Downloader</path><vendor>PUP.Optional.Softonic.A</vendor><action>success</action><hash>b4cd752f80fb2e08050fbd27639fb848</hash></key>
<key><path>HKU\S-1-5-21-3534363647-1427521627-2892733247-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\WEBCONNECT</path><vendor>PUP.Optional.WebConnect.A</vendor><action>success</action><hash>9be6564e1a617fb73231bd4fc143dc24</hash></key>
<value><path>HKU\S-1-5-21-3534363647-1427521627-2892733247-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN</path><valuename>Yahoo! Search</valuename><vendor>PUP.Optional.PayByAds.A</vendor><action>success</action><valuedata>C:\Users\Heinz\AppData\Local\Pay-By-Ads\Yahoo! Search\1.3.8.2\dsrlte.exe</valuedata><hash>4b365e46e19a26105b46ce1629dbd22e</hash></value>
<value><path>HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\SOFTWAREUPDATER</path><valuename>UninstallString</valuename><vendor>PUP.Optional.SoftwareUpdater</vendor><action>success</action><valuedata>C:\Program Files (x86)\SoftwareUpdater\uninstall.exe</valuedata><hash>7d04c2e2e3986dc9e314c963e81c09f7</hash></value>
<value><path>HKLM\SOFTWARE\WOW6432NODE\SOFTWAREUPDATER</path><valuename>partner_keyword</valuename><vendor>PUP.Optional.SoftwareUpdater.A</vendor><action>success</action><valuedata>ALLFILEWINCOM</valuedata><hash>60217d275724ce68a1cd40cc699ba65a</hash></value>
<value><path>HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\SRVUPDATER</path><valuename>ImagePath</valuename><vendor>PUP.Optional.SoftwareUpdater.A</vendor><action>success</action><valuedata>C:\Program Files (x86)\SoftwareUpdater\UpdaterService.exe</valuedata><hash>bcc5fda702791b1bf17a1eeab74d9e62</hash></value>
<value><path>HKU\S-1-5-21-3534363647-1427521627-2892733247-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\INSTALLCORE</path><valuename>tb</valuename><vendor>PUP.Optional.InstallCore.A</vendor><action>success</action><valuedata>0L1N1H2O1S</valuedata><hash>cdb4e8bcb6c578bedf369a71a163bd43</hash></value>
<value><path>HKU\S-1-5-21-3534363647-1427521627-2892733247-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\WEBCONNECT</path><valuename>iid</valuename><vendor>PUP.Optional.WebConnect.A</vendor><action>success</action><valuedata>def_WebConnect</valuedata><hash>9be6564e1a617fb73231bd4fc143dc24</hash></value>
<folder><path>C:\ProgramData\eSafe\log</path><vendor>PUP.Optional.eSafe.A</vendor><action>success</action><hash>f48d495b95e61026e760d819cc3658a8</hash></folder>
<folder><path>C:\Program Files (x86)\SoftwareUpdater</path><vendor>PUP.Optional.SoftwareUpdater.A</vendor><action>delete-on-reboot</action><hash>a8d9d0d4611a4ee8eb81848422e203fd</hash></folder>
<folder><path>C:\Users\Heinz\AppData\Roaming\Desk 365</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>4839e2c2b9c280b694533ace1fe547b9</hash></folder>
<folder><path>C:\Users\Heinz\AppData\Roaming\Desk 365\app</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>4839e2c2b9c280b694533ace1fe547b9</hash></folder>
<folder><path>C:\Users\Heinz\AppData\Roaming\Desk 365\app\config</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>4839e2c2b9c280b694533ace1fe547b9</hash></folder>
<folder><path>C:\Users\Heinz\AppData\Roaming\Desk 365\app\config\1</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>4839e2c2b9c280b694533ace1fe547b9</hash></folder>
<folder><path>C:\Users\Heinz\AppData\Roaming\Desk 365\app\config\3</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>4839e2c2b9c280b694533ace1fe547b9</hash></folder>
<folder><path>C:\Users\Heinz\AppData\Roaming\Desk 365\app\config\35</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>4839e2c2b9c280b694533ace1fe547b9</hash></folder>
<folder><path>C:\Users\Heinz\AppData\Roaming\Desk 365\app\config\36</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>4839e2c2b9c280b694533ace1fe547b9</hash></folder>
<folder><path>C:\Users\Heinz\AppData\Roaming\Desk 365\app\config\39</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>4839e2c2b9c280b694533ace1fe547b9</hash></folder>
<folder><path>C:\Users\Heinz\AppData\Roaming\Desk 365\app\config\4</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>4839e2c2b9c280b694533ace1fe547b9</hash></folder>
<folder><path>C:\Users\Heinz\AppData\Roaming\Desk 365\app\config\41</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>4839e2c2b9c280b694533ace1fe547b9</hash></folder>
<folder><path>C:\Users\Heinz\AppData\Roaming\Desk 365\app\config\42</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>4839e2c2b9c280b694533ace1fe547b9</hash></folder>
<folder><path>C:\Users\Heinz\AppData\Roaming\Desk 365\components</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>4839e2c2b9c280b694533ace1fe547b9</hash></folder>
<folder><path>C:\Users\Heinz\AppData\Roaming\Desk 365\desk_bkg</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>4839e2c2b9c280b694533ace1fe547b9</hash></folder>
<folder><path>C:\Users\Heinz\AppData\Roaming\Desk 365\icons</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>4839e2c2b9c280b694533ace1fe547b9</hash></folder>
<folder><path>C:\Users\Heinz\AppData\Roaming\Desk 365\promote</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>4839e2c2b9c280b694533ace1fe547b9</hash></folder>
<folder><path>C:\Users\Heinz\AppData\Roaming\Desk 365\sysicons</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>4839e2c2b9c280b694533ace1fe547b9</hash></folder>
<folder><path>C:\Users\Heinz\AppData\Roaming\Desk 365\wp</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>4839e2c2b9c280b694533ace1fe547b9</hash></folder>
<folder><path>C:\Program Files (x86)\Desk 365</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>6c1572321269be7829bf3bcd857f25db</hash></folder>
<folder><path>C:\Users\Heinz\AppData\Local\Temp\Desk365\eInstall</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>2160cdd793e876c0c34ff4b5cf338977</hash></folder>
<folder><path>C:\Users\Heinz\AppData\Local\Temp\Desk365\eInstall\image</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>2160cdd793e876c0c34ff4b5cf338977</hash></folder>
<folder><path>C:\Users\Heinz\AppData\Local\Temp\Desk365\eInstall\image\default</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>2160cdd793e876c0c34ff4b5cf338977</hash></folder>
<folder><path>C:\Users\Heinz\AppData\Local\Temp\Desk365\eInstall\Install</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>2160cdd793e876c0c34ff4b5cf338977</hash></folder>
<folder><path>C:\Users\Heinz\AppData\Local\Temp\Desk365\eInstall\language</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>2160cdd793e876c0c34ff4b5cf338977</hash></folder>
<folder><path>C:\Users\Heinz\AppData\Local\Temp\Desk365\eInstall\language\en_us</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>2160cdd793e876c0c34ff4b5cf338977</hash></folder>
<folder><path>C:\Users\Heinz\AppData\Local\Temp\Desk365\eInstall\language\es_es</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>2160cdd793e876c0c34ff4b5cf338977</hash></folder>
<folder><path>C:\Users\Heinz\AppData\Local\Temp\Desk365\eInstall\language\pt_br</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>2160cdd793e876c0c34ff4b5cf338977</hash></folder>
<folder><path>C:\Users\Heinz\AppData\Local\Temp\Desk365\eInstall\language\tr_tr</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>2160cdd793e876c0c34ff4b5cf338977</hash></folder>
<folder><path>C:\Users\Heinz\AppData\Local\Temp\Desk365\eInstall\language\zh_cn</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>2160cdd793e876c0c34ff4b5cf338977</hash></folder>
<folder><path>C:\Users\Heinz\AppData\Local\Temp\Desk365\eInstall\language\zh_tw</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>2160cdd793e876c0c34ff4b5cf338977</hash></folder>
<folder><path>C:\Users\Heinz\AppData\Local\Temp\Desk365\eInstall\layout</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>2160cdd793e876c0c34ff4b5cf338977</hash></folder>
<folder><path>C:\Users\Heinz\AppData\Local\Temp\Desk365\eInstall\layout\default</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>2160cdd793e876c0c34ff4b5cf338977</hash></folder>
<folder><path>C:\Users\Heinz\AppData\Local\Temp\Desk365\eInstall\style</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>2160cdd793e876c0c34ff4b5cf338977</hash></folder>
<folder><path>C:\Program Files (x86)\Common Files\337\libcef</path><vendor>PUP.Optional.337Technologies.A</vendor><action>success</action><hash>b3ce3a6a403bf4423adb86230ff312ee</hash></folder>
<folder><path>C:\Program Files (x86)\Common Files\337\libcef\1.1364.1123</path><vendor>PUP.Optional.337Technologies.A</vendor><action>success</action><hash>b3ce3a6a403bf4423adb86230ff312ee</hash></folder>
<folder><path>C:\Program Files (x86)\Common Files\337\libcef\1.1364.1123\locales</path><vendor>PUP.Optional.337Technologies.A</vendor><action>success</action><hash>b3ce3a6a403bf4423adb86230ff312ee</hash></folder>
<folder><path>C:\Users\Heinz\AppData\Local\Pay-By-Ads</path><vendor>PUP.Optional.PayByAds.A</vendor><action>delete-on-reboot</action><hash>f48dcdd766154beb27c2cdf319e9c33d</hash></folder>
<folder><path>C:\Users\Heinz\AppData\Local\Pay-By-Ads\Yahoo! Search</path><vendor>PUP.Optional.PayByAds.A</vendor><action>delete-on-reboot</action><hash>f48dcdd766154beb27c2cdf319e9c33d</hash></folder>
<folder><path>C:\Users\Heinz\AppData\Local\Pay-By-Ads\Yahoo! Search\1.3.8.2</path><vendor>PUP.Optional.PayByAds.A</vendor><action>delete-on-reboot</action><hash>f48dcdd766154beb27c2cdf319e9c33d</hash></folder>
<file><path>C:\Program Files (x86)\SoftwareUpdater\UpdaterService.exe</path><vendor>PUP.Optional.SoftwareUpdater.A</vendor><action>delete-on-reboot</action><hash>f38e594b4a31ca6c4df127f00bf63cc4</hash></file>
<file><path>C:\Program Files (x86)\WebConnect\updateWebConnect.exe</path><vendor>PUP.Optional.WebConnect.A</vendor><action>delete-on-reboot</action><hash>9ce5aff52259fc3a28d51449f30e6898</hash></file>
<file><path>C:\Program Files (x86)\WebConnect\bin\utilWebConnect.exe</path><vendor>PUP.Optional.WebConnect.A</vendor><action>delete-on-reboot</action><hash>2958604496e53105708daab319e8ae52</hash></file>
<file><path>C:\Users\Heinz\AppData\Local\Pay-By-Ads\Yahoo! Search\1.3.8.2\dsrlte.exe</path><vendor>PUP.Optional.PayByAds.A</vendor><action>delete-on-reboot</action><hash>4b365e46e19a26105b46ce1629dbd22e</hash></file>
<file><path>C:\Users\Heinz\AppData\Roaming\Desk 365\components\component_libcef_1.1364.1123.exe</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>39485c48cbb01f17f632db012bd9cf31</hash></file>
<file><path>C:\$Recycle.Bin\S-1-5-21-3534363647-1427521627-2892733247-1000\$R5ZU2N6.exe</path><vendor>PUP.Optional.OptimizerPro</vendor><action>success</action><hash>1e63762ed3a804326473b17f639e52ae</hash></file>
<file><path>C:\Users\Heinz\AppData\Local\Temp\instloffer.exe</path><vendor>PUP.Optional.Vittalia</vendor><action>success</action><hash>8af7fda7215a66d0fbf208a822dfa55b</hash></file>
<file><path>C:\Users\Heinz\AppData\Local\Temp\Setup.exe\efcbea222c7a44a0adc609f06e3defab\eSetup.exe</path><vendor>PUP.Optional.MSILLauncher.A</vendor><action>success</action><hash>235ef4b096e586b0a53cd73f946d16ea</hash></file>
<file><path>C:\Users\Heinz\AppData\Local\Temp\Setup.exe\efcbea222c7a44a0adc609f06e3defab\installer.exe</path><vendor>PUP.Optional.MSILLauncher.A</vendor><action>success</action><hash>770af8ac8af1280ead343bdbc33ead53</hash></file>
<file><path>C:\Users\Heinz\AppData\Local\Temp\Setup.exe\efcbea222c7a44a0adc609f06e3defab\software\Delta Babylon.exe</path><vendor>PUP.Optional.DeltaTB</vendor><action>success</action><hash>a7dad0d4fb80f343d0bf60c08779c43c</hash></file>
<file><path>C:\Users\Heinz\AppData\Local\Temp\Setup.exe\efcbea222c7a44a0adc609f06e3defab\software\Desk365.exe</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>94ed2a7a2e4df34364c4716b18ec8e72</hash></file>
<file><path>C:\Users\Heinz\AppData\Local\Temp\Setup.exe\efcbea222c7a44a0adc609f06e3defab\software\OptimizerPro.exe</path><vendor>PUP.Optional.OptimizePro.A</vendor><action>success</action><hash>41400d975c1f0e284e0127f71be5b64a</hash></file>
<file><path>C:\Users\Heinz\AppData\Local\Temp\Setup.exe\efcbea222c7a44a0adc609f06e3defab\software\Setup.exe</path><vendor>PUP.Optional.Tugluu.A</vendor><action>success</action><hash>a7dab4f0d9a28ea85cef58d89b6745bb</hash></file>
<file><path>C:\Users\Heinz\AppData\Local\Temp\Desk365\eInstall\eInstall.exe</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>98e95f450b7045f1f19c28f503fe16ea</hash></file>
<file><path>C:\Users\Heinz\AppData\Local\Temp\nseDBAF.tmp\tkDecript.dll</path><vendor>PUP.Optional.Vittalia</vendor><action>success</action><hash>b4cd4b596b1088aecb22ecc4bd4425db</hash></file>
<file><path>C:\Users\Heinz\AppData\Local\Temp\BFFD9C9F-BAB0-7891-B2A7-8E09C2F4DB12\ccp.exe</path><vendor>Trojan.RotBrowse</vendor><action>success</action><hash>631ec5df86f5a294904d4955c044837d</hash></file>
<file><path>C:\Users\Heinz\AppData\Local\Temp\BFFD9C9F-BAB0-7891-B2A7-8E09C2F4DB12\CrxInstaller.dll</path><vendor>PUP.Optional.Babylon.A</vendor><action>success</action><hash>641de3c16a11e15540b6b26f8f72bf41</hash></file>
<file><path>C:\Users\Heinz\AppData\Local\Temp\BFFD9C9F-BAB0-7891-B2A7-8E09C2F4DB12\MyBabylonTB.exe</path><vendor>PUP.Optional.Delta.A</vendor><action>success</action><hash>5031d8cc72098aac5aa2cdabe0210ef2</hash></file>
<file><path>C:\Users\Heinz\AppData\Local\Temp\BFFD9C9F-BAB0-7891-B2A7-8E09C2F4DB12\Setup.exe</path><vendor>PUP.Optional.Babylon.A</vendor><action>success</action><hash>324f287cfa8155e14fffa77918e845bb</hash></file>
<file><path>C:\Users\Heinz\AppData\Local\Temp\60DC5A58-BAB0-7891-B94F-3CFD5F3E4F38\BUSolution.dll</path><vendor>PUP.Optional.BabSolution.A</vendor><action>success</action><hash>3c45bee64a314de9073a809544bd639d</hash></file>
<file><path>C:\Users\Heinz\AppData\Local\Temp\60DC5A58-BAB0-7891-B94F-3CFD5F3E4F38\ccp.exe</path><vendor>Trojan.RotBrowse</vendor><action>success</action><hash>bcc5fda7accf2e083da0f5a9dd272bd5</hash></file>
<file><path>C:\Users\Heinz\AppData\Local\Temp\60DC5A58-BAB0-7891-B94F-3CFD5F3E4F38\CrxInstaller.dll</path><vendor>PUP.Optional.Babylon.A</vendor><action>success</action><hash>e1a04163adce68ce8e68928fbe43e41c</hash></file>
<file><path>C:\Users\Heinz\AppData\Local\Temp\60DC5A58-BAB0-7891-B94F-3CFD5F3E4F38\MntrDLLInstall.dll</path><vendor>PUP.Optional.Babylon.A</vendor><action>success</action><hash>542ddacad6a5989e8671a27fd22fd52b</hash></file>
<file><path>C:\Users\Heinz\AppData\Local\Temp\60DC5A58-BAB0-7891-B94F-3CFD5F3E4F38\MyDeltaTB.exe</path><vendor>PUP.Optional.Delta.A</vendor><action>success</action><hash>433e1c883e3d60d646b64a2ed62b7b85</hash></file>
<file><path>C:\Users\Heinz\AppData\Local\Temp\is1135169017\387750_stp\DeltaTB.exe</path><vendor>PUP.Optional.Babylon.A</vendor><action>success</action><hash>6c151193de9da393bc11af5f60a1768a</hash></file>
<file><path>C:\Users\Heinz\AppData\Local\Temp\is1135169017\387765_stp\WebConnect.exe</path><vendor>PUP.Optional.WebConnect.A</vendor><action>success</action><hash>e1a0455fa8d3c96d15273b37ec1805fb</hash></file>
<file><path>C:\Users\Heinz\AppData\Local\Temp\is1135169017\387968_stp\OptimizerPro.exe</path><vendor>PUP.Optional.OptimizePro.A</vendor><action>success</action><hash>68192d771b60d462024dbd615ba5619f</hash></file>
<file><path>C:\Windows\Temp\updater\KeyGen.dll</path><vendor>Trojan.SProtector</vendor><action>success</action><hash>0e7381234b302e08fa7e5b2ce41d0ef2</hash></file>
<file><path>C:\ProgramData\eSafe\log\eGdpSvc.LOG</path><vendor>PUP.Optional.eSafe.A</vendor><action>success</action><hash>f48d495b95e61026e760d819cc3658a8</hash></file>
<file><path>C:\Program Files (x86)\SoftwareUpdater\KeyGen.dll</path><vendor>PUP.Optional.SoftwareUpdater.A</vendor><action>delete-on-reboot</action><hash>a8d9d0d4611a4ee8eb81848422e203fd</hash></file>
<file><path>C:\Program Files (x86)\SoftwareUpdater\AppsUpdater.exe</path><vendor>PUP.Optional.SoftwareUpdater.A</vendor><action>delete-on-reboot</action><hash>a8d9d0d4611a4ee8eb81848422e203fd</hash></file>
<file><path>C:\Program Files (x86)\SoftwareUpdater\AppsUpdater.exe.config</path><vendor>PUP.Optional.SoftwareUpdater.A</vendor><action>success</action><hash>a8d9d0d4611a4ee8eb81848422e203fd</hash></file>
<file><path>C:\Program Files (x86)\SoftwareUpdater\config.xml</path><vendor>PUP.Optional.SoftwareUpdater.A</vendor><action>success</action><hash>a8d9d0d4611a4ee8eb81848422e203fd</hash></file>
<file><path>C:\Program Files (x86)\SoftwareUpdater\Interop.Shell32.dll</path><vendor>PUP.Optional.SoftwareUpdater.A</vendor><action>delete-on-reboot</action><hash>a8d9d0d4611a4ee8eb81848422e203fd</hash></file>
<file><path>C:\Program Files (x86)\SoftwareUpdater\translations.xml</path><vendor>PUP.Optional.SoftwareUpdater.A</vendor><action>success</action><hash>a8d9d0d4611a4ee8eb81848422e203fd</hash></file>
<file><path>C:\Program Files (x86)\SoftwareUpdater\uninstall.exe</path><vendor>PUP.Optional.SoftwareUpdater.A</vendor><action>success</action><hash>a8d9d0d4611a4ee8eb81848422e203fd</hash></file>
<file><path>C:\Users\Heinz\AppData\Roaming\Desk 365\promote.xml</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>4839e2c2b9c280b694533ace1fe547b9</hash></file>
<file><path>C:\Users\Heinz\AppData\Roaming\Desk 365\desk_bkg_list.xml</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>4839e2c2b9c280b694533ace1fe547b9</hash></file>
<file><path>C:\Users\Heinz\AppData\Roaming\Desk 365\desk_list.xml</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>4839e2c2b9c280b694533ace1fe547b9</hash></file>
<file><path>C:\Users\Heinz\AppData\Roaming\Desk 365\desk_settings.ini</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>4839e2c2b9c280b694533ace1fe547b9</hash></file>
<file><path>C:\Users\Heinz\AppData\Roaming\Desk 365\process_mgr.xml</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>4839e2c2b9c280b694533ace1fe547b9</hash></file>
<file><path>C:\Users\Heinz\AppData\Roaming\Desk 365\app\config\1\angrybirds.db</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>4839e2c2b9c280b694533ace1fe547b9</hash></file>
<file><path>C:\Users\Heinz\AppData\Roaming\Desk 365\app\config\1\angrybirds.ico</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>4839e2c2b9c280b694533ace1fe547b9</hash></file>
<file><path>C:\Users\Heinz\AppData\Roaming\Desk 365\app\config\3\BigFarm.db</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>4839e2c2b9c280b694533ace1fe547b9</hash></file>
<file><path>C:\Users\Heinz\AppData\Roaming\Desk 365\app\config\3\BigFarm.ico</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>4839e2c2b9c280b694533ace1fe547b9</hash></file>
<file><path>C:\Users\Heinz\AppData\Roaming\Desk 365\app\config\35\Gmail.db</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>4839e2c2b9c280b694533ace1fe547b9</hash></file>
<file><path>C:\Users\Heinz\AppData\Roaming\Desk 365\app\config\35\Gmail.ico</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>4839e2c2b9c280b694533ace1fe547b9</hash></file>
<file><path>C:\Users\Heinz\AppData\Roaming\Desk 365\app\config\36\Outlook.db</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>4839e2c2b9c280b694533ace1fe547b9</hash></file>
<file><path>C:\Users\Heinz\AppData\Roaming\Desk 365\app\config\36\Outlook.ico</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>4839e2c2b9c280b694533ace1fe547b9</hash></file>
<file><path>C:\Users\Heinz\AppData\Roaming\Desk 365\app\config\39\ESPN.db</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>4839e2c2b9c280b694533ace1fe547b9</hash></file>
<file><path>C:\Users\Heinz\AppData\Roaming\Desk 365\app\config\39\ESPN.ico</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>4839e2c2b9c280b694533ace1fe547b9</hash></file>
<file><path>C:\Users\Heinz\AppData\Roaming\Desk 365\app\config\4\Empire.db</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>4839e2c2b9c280b694533ace1fe547b9</hash></file>
<file><path>C:\Users\Heinz\AppData\Roaming\Desk 365\app\config\4\Empire.ico</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>4839e2c2b9c280b694533ace1fe547b9</hash></file>
<file><path>C:\Users\Heinz\AppData\Roaming\Desk 365\app\config\41\gcalendar.db</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>4839e2c2b9c280b694533ace1fe547b9</hash></file>
<file><path>C:\Users\Heinz\AppData\Roaming\Desk 365\app\config\41\gcalendar.ico</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>4839e2c2b9c280b694533ace1fe547b9</hash></file>
<file><path>C:\Users\Heinz\AppData\Roaming\Desk 365\app\config\42\pulse.db</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>4839e2c2b9c280b694533ace1fe547b9</hash></file>
<file><path>C:\Users\Heinz\AppData\Roaming\Desk 365\app\config\42\pulse.ico</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>4839e2c2b9c280b694533ace1fe547b9</hash></file>
<file><path>C:\Users\Heinz\AppData\Roaming\Desk 365\desk_bkg\desk_bkg_1.png</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>4839e2c2b9c280b694533ace1fe547b9</hash></file>
<file><path>C:\Users\Heinz\AppData\Roaming\Desk 365\desk_bkg\desk_bkg_2.png</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>4839e2c2b9c280b694533ace1fe547b9</hash></file>
<file><path>C:\Users\Heinz\AppData\Roaming\Desk 365\desk_bkg\desk_bkg_3.png</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>4839e2c2b9c280b694533ace1fe547b9</hash></file>
<file><path>C:\Users\Heinz\AppData\Roaming\Desk 365\desk_bkg\desk_bkg_4.png</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>4839e2c2b9c280b694533ace1fe547b9</hash></file>
<file><path>C:\Users\Heinz\AppData\Roaming\Desk 365\desk_bkg\desk_bkg_5.png</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>4839e2c2b9c280b694533ace1fe547b9</hash></file>
<file><path>C:\Users\Heinz\AppData\Roaming\Desk 365\desk_bkg\desk_bkg_default.png</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>4839e2c2b9c280b694533ace1fe547b9</hash></file>
<file><path>C:\Users\Heinz\AppData\Roaming\Desk 365\icons\iexplore_ee43df38ca14bfac5699021d2ffa2cb2_48_48.png</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>4839e2c2b9c280b694533ace1fe547b9</hash></file>
<file><path>C:\Users\Heinz\AppData\Roaming\Desk 365\icons\337_7c9140b13c049fd26989f7fa25b77cb1_48_48.png</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>4839e2c2b9c280b694533ace1fe547b9</hash></file>
<file><path>C:\Users\Heinz\AppData\Roaming\Desk 365\icons\angrybirds_00ff92c12703baaf0130d6aec427d047_48_48.png</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>4839e2c2b9c280b694533ace1fe547b9</hash></file>
<file><path>C:\Users\Heinz\AppData\Roaming\Desk 365\icons\Barbie_00a67ff4ef657679a6c88553135d62ad_48_48.png</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>4839e2c2b9c280b694533ace1fe547b9</hash></file>
<file><path>C:\Users\Heinz\AppData\Roaming\Desk 365\icons\BigFarm_de933b0e5218a4db24bebe3d55ed3558_48_48.png</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>4839e2c2b9c280b694533ace1fe547b9</hash></file>
<file><path>C:\Users\Heinz\AppData\Roaming\Desk 365\icons\chrome_a6a6966da5bc1fec7f04e834c3946096.ico</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>4839e2c2b9c280b694533ace1fe547b9</hash></file>
<file><path>C:\Users\Heinz\AppData\Roaming\Desk 365\icons\chrome_a6a6966da5bc1fec7f04e834c3946096_48_48.png</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>4839e2c2b9c280b694533ace1fe547b9</hash></file>
<file><path>C:\Users\Heinz\AppData\Roaming\Desk 365\icons\Empire_22b42f57d1c467841280810e218d5510_48_48.png</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>4839e2c2b9c280b694533ace1fe547b9</hash></file>
<file><path>C:\Users\Heinz\AppData\Roaming\Desk 365\icons\ESPN_a7b078f5f5f5b87efcef66ab5783cf9d_48_48.png</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>4839e2c2b9c280b694533ace1fe547b9</hash></file>
<file><path>C:\Users\Heinz\AppData\Roaming\Desk 365\icons\Facebook_aab07bc79cf599b25c0110f32d46a3ef_48_48.png</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>4839e2c2b9c280b694533ace1fe547b9</hash></file>
<file><path>C:\Users\Heinz\AppData\Roaming\Desk 365\icons\gcalendar_50b3e3c5fc202f0cfcae8032b2465c1b_48_48.png</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>4839e2c2b9c280b694533ace1fe547b9</hash></file>
<file><path>C:\Users\Heinz\AppData\Roaming\Desk 365\icons\Gmail_731b6d011bd9f67463a916a496775935_48_48.png</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>4839e2c2b9c280b694533ace1fe547b9</hash></file>
<file><path>C:\Users\Heinz\AppData\Roaming\Desk 365\icons\Google_60d75cb277f0c452fa60dba8350caf65_48_48.png</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>4839e2c2b9c280b694533ace1fe547b9</hash></file>
<file><path>C:\Users\Heinz\AppData\Roaming\Desk 365\icons\iexplore_ee43df38ca14bfac5699021d2ffa2cb2.ico</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>4839e2c2b9c280b694533ace1fe547b9</hash></file>
<file><path>C:\Users\Heinz\AppData\Roaming\Desk 365\icons\Mario_52934d81761dc31187a93a3a0be7fecc_48_48.png</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>4839e2c2b9c280b694533ace1fe547b9</hash></file>
<file><path>C:\Users\Heinz\AppData\Roaming\Desk 365\icons\Outlook_6f817b67fa6af1a9c8abfa3813a8595c_48_48.png</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>4839e2c2b9c280b694533ace1fe547b9</hash></file>
<file><path>C:\Users\Heinz\AppData\Roaming\Desk 365\icons\pulse_b5a242da04cc06eacd02b1ca41e3583c_48_48.png</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>4839e2c2b9c280b694533ace1fe547b9</hash></file>
<file><path>C:\Users\Heinz\AppData\Roaming\Desk 365\icons\sys_computer_48_48.png</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>4839e2c2b9c280b694533ace1fe547b9</hash></file>
<file><path>C:\Users\Heinz\AppData\Roaming\Desk 365\icons\sys_control_panel_48_48.png</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>4839e2c2b9c280b694533ace1fe547b9</hash></file>
<file><path>C:\Users\Heinz\AppData\Roaming\Desk 365\icons\sys_my_documents_48_48.png</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>4839e2c2b9c280b694533ace1fe547b9</hash></file>
<file><path>C:\Users\Heinz\AppData\Roaming\Desk 365\icons\Twitter_ebddd85ec04b7b94a2b2e97b73a90a4a_48_48.png</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>4839e2c2b9c280b694533ace1fe547b9</hash></file>
<file><path>C:\Users\Heinz\AppData\Roaming\Desk 365\icons\Youtube_bf18fdfc4aefd6417a8bacae4be5b415_48_48.png</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>4839e2c2b9c280b694533ace1fe547b9</hash></file>
<file><path>C:\Users\Heinz\AppData\Roaming\Desk 365\promote\337.ico</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>4839e2c2b9c280b694533ace1fe547b9</hash></file>
<file><path>C:\Users\Heinz\AppData\Roaming\Desk 365\promote\337_7c9140b13c049fd26989f7fa25b77cb1.ico</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>4839e2c2b9c280b694533ace1fe547b9</hash></file>
<file><path>C:\Users\Heinz\AppData\Roaming\Desk 365\promote\barbie.ico</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>4839e2c2b9c280b694533ace1fe547b9</hash></file>
<file><path>C:\Users\Heinz\AppData\Roaming\Desk 365\promote\Barbie_00a67ff4ef657679a6c88553135d62ad.ico</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>4839e2c2b9c280b694533ace1fe547b9</hash></file>
<file><path>C:\Users\Heinz\AppData\Roaming\Desk 365\promote\facebook.ico</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>4839e2c2b9c280b694533ace1fe547b9</hash></file>
<file><path>C:\Users\Heinz\AppData\Roaming\Desk 365\promote\Facebook_aab07bc79cf599b25c0110f32d46a3ef.ico</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>4839e2c2b9c280b694533ace1fe547b9</hash></file>
<file><path>C:\Users\Heinz\AppData\Roaming\Desk 365\promote\GameCenter.ico</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>4839e2c2b9c280b694533ace1fe547b9</hash></file>
<file><path>C:\Users\Heinz\AppData\Roaming\Desk 365\promote\google.ico</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>4839e2c2b9c280b694533ace1fe547b9</hash></file>
<file><path>C:\Users\Heinz\AppData\Roaming\Desk 365\promote\Google_60d75cb277f0c452fa60dba8350caf65.ico</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>4839e2c2b9c280b694533ace1fe547b9</hash></file>
<file><path>C:\Users\Heinz\AppData\Roaming\Desk 365\promote\mario.ico</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>4839e2c2b9c280b694533ace1fe547b9</hash></file>
<file><path>C:\Users\Heinz\AppData\Roaming\Desk 365\promote\Mario_52934d81761dc31187a93a3a0be7fecc.ico</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>4839e2c2b9c280b694533ace1fe547b9</hash></file>
<file><path>C:\Users\Heinz\AppData\Roaming\Desk 365\promote\twitter.ico</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>4839e2c2b9c280b694533ace1fe547b9</hash></file>
<file><path>C:\Users\Heinz\AppData\Roaming\Desk 365\promote\Twitter_ebddd85ec04b7b94a2b2e97b73a90a4a.ico</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>4839e2c2b9c280b694533ace1fe547b9</hash></file>
<file><path>C:\Users\Heinz\AppData\Roaming\Desk 365\promote\v9.ico</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>4839e2c2b9c280b694533ace1fe547b9</hash></file>
<file><path>C:\Users\Heinz\AppData\Roaming\Desk 365\promote\youtube.ico</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>4839e2c2b9c280b694533ace1fe547b9</hash></file>
<file><path>C:\Users\Heinz\AppData\Roaming\Desk 365\promote\Youtube_bf18fdfc4aefd6417a8bacae4be5b415.ico</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>4839e2c2b9c280b694533ace1fe547b9</hash></file>
<file><path>C:\Users\Heinz\AppData\Roaming\Desk 365\sysicons\0737cc0646562366bf607aa1fa2a03bd_21.ico</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>4839e2c2b9c280b694533ace1fe547b9</hash></file>
<file><path>C:\Users\Heinz\AppData\Roaming\Desk 365\sysicons\07584c03a5dd11a6104e45e8ad03b3fe_104.ico</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>4839e2c2b9c280b694533ace1fe547b9</hash></file>
<file><path>C:\Users\Heinz\AppData\Roaming\Desk 365\sysicons\07584c03a5dd11a6104e45e8ad03b3fe_107.ico</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>4839e2c2b9c280b694533ace1fe547b9</hash></file>
<file><path>C:\Users\Heinz\AppData\Roaming\Desk 365\wp\r0.jpg</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>4839e2c2b9c280b694533ace1fe547b9</hash></file>
<file><path>C:\Users\Heinz\AppData\Roaming\Desk 365\wp\r1.jpg</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>4839e2c2b9c280b694533ace1fe547b9</hash></file>
<file><path>C:\Users\Heinz\AppData\Roaming\Desk 365\wp\r2.jpg</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>4839e2c2b9c280b694533ace1fe547b9</hash></file>
<file><path>C:\Users\Heinz\AppData\Roaming\Desk 365\wp\r3.jpg</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>4839e2c2b9c280b694533ace1fe547b9</hash></file>
<file><path>C:\Users\Heinz\AppData\Roaming\Desk 365\wp\r4.jpg</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>4839e2c2b9c280b694533ace1fe547b9</hash></file>
<file><path>C:\Users\Heinz\AppData\Roaming\Desk 365\wp\r5.jpg</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>4839e2c2b9c280b694533ace1fe547b9</hash></file>
<file><path>C:\Users\Heinz\AppData\Roaming\Desk 365\wp\r6.jpg</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>4839e2c2b9c280b694533ace1fe547b9</hash></file>
<file><path>C:\Users\Heinz\AppData\Roaming\Desk 365\wp\r7.jpg</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>4839e2c2b9c280b694533ace1fe547b9</hash></file>
<file><path>C:\Users\Heinz\AppData\Roaming\Desk 365\wp\r8.jpg</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>4839e2c2b9c280b694533ace1fe547b9</hash></file>
<file><path>C:\Users\Heinz\AppData\Roaming\Desk 365\wp\r9.jpg</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>4839e2c2b9c280b694533ace1fe547b9</hash></file>
<file><path>C:\Program Files (x86)\Desk 365\promote.xml</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>6c1572321269be7829bf3bcd857f25db</hash></file>
<file><path>C:\Program Files (x86)\Desk 365\desk_bkg_list.xml</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>6c1572321269be7829bf3bcd857f25db</hash></file>
<file><path>C:\Program Files (x86)\Desk 365\desk_list.xml</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>6c1572321269be7829bf3bcd857f25db</hash></file>
<file><path>C:\Program Files (x86)\Desk 365\desk_settings.ini</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>6c1572321269be7829bf3bcd857f25db</hash></file>
<file><path>C:\Program Files (x86)\Desk 365\process_mgr.xml</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>6c1572321269be7829bf3bcd857f25db</hash></file>
<file><path>C:\Program Files (x86)\Desk 365\recent.xml</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>6c1572321269be7829bf3bcd857f25db</hash></file>
<file><path>C:\Windows\System32\drivers\{664f7cae-01d9-48b5-bc90-e3c3d6bb0ddb}w64.sys</path><vendor>PUP.Optional.Sanbreel.A</vendor><action>success</action><hash>a7da4c58dd9ee84e0df69893de269d63</hash></file>
<file><path>C:\Users\Heinz\AppData\Local\Temp\Desk365\eInstall\main</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>2160cdd793e876c0c34ff4b5cf338977</hash></file>
<file><path>C:\Users\Heinz\AppData\Local\Temp\Desk365\eInstall\msvcp100.dll</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>2160cdd793e876c0c34ff4b5cf338977</hash></file>
<file><path>C:\Users\Heinz\AppData\Local\Temp\Desk365\eInstall\msvcr100.dll</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>2160cdd793e876c0c34ff4b5cf338977</hash></file>
<file><path>C:\Users\Heinz\AppData\Local\Temp\Desk365\eInstall\segoeui.ttf</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>2160cdd793e876c0c34ff4b5cf338977</hash></file>
<file><path>C:\Users\Heinz\AppData\Local\Temp\Desk365\eInstall\segoeuib.ttf</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>2160cdd793e876c0c34ff4b5cf338977</hash></file>
<file><path>C:\Users\Heinz\AppData\Local\Temp\Desk365\eInstall\image\default\app_icon.png</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>2160cdd793e876c0c34ff4b5cf338977</hash></file>
<file><path>C:\Users\Heinz\AppData\Local\Temp\Desk365\eInstall\image\default\change_skin.png</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>2160cdd793e876c0c34ff4b5cf338977</hash></file>
<file><path>C:\Users\Heinz\AppData\Local\Temp\Desk365\eInstall\image\default\combo_skin.png</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>2160cdd793e876c0c34ff4b5cf338977</hash></file>
<file><path>C:\Users\Heinz\AppData\Local\Temp\Desk365\eInstall\image\default\edit_skin.png</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>2160cdd793e876c0c34ff4b5cf338977</hash></file>
<file><path>C:\Users\Heinz\AppData\Local\Temp\Desk365\eInstall\image\default\install_back.png</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>2160cdd793e876c0c34ff4b5cf338977</hash></file>
<file><path>C:\Users\Heinz\AppData\Local\Temp\Desk365\eInstall\image\default\install_button_skin.png</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>2160cdd793e876c0c34ff4b5cf338977</hash></file>
<file><path>C:\Users\Heinz\AppData\Local\Temp\Desk365\eInstall\image\default\install_check_checked.png</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>2160cdd793e876c0c34ff4b5cf338977</hash></file>
<file><path>C:\Users\Heinz\AppData\Local\Temp\Desk365\eInstall\image\default\install_check_intermediate.png</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>2160cdd793e876c0c34ff4b5cf338977</hash></file>
<file><path>C:\Users\Heinz\AppData\Local\Temp\Desk365\eInstall\image\default\install_check_uncheck.png</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>2160cdd793e876c0c34ff4b5cf338977</hash></file>
<file><path>C:\Users\Heinz\AppData\Local\Temp\Desk365\eInstall\image\default\install_logo.png</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>2160cdd793e876c0c34ff4b5cf338977</hash></file>
<file><path>C:\Users\Heinz\AppData\Local\Temp\Desk365\eInstall\image\default\install_resource.xml</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>2160cdd793e876c0c34ff4b5cf338977</hash></file>
<file><path>C:\Users\Heinz\AppData\Local\Temp\Desk365\eInstall\image\default\patch_file_icon.png</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>2160cdd793e876c0c34ff4b5cf338977</hash></file>
<file><path>C:\Users\Heinz\AppData\Local\Temp\Desk365\eInstall\image\default\pic-error.png</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>2160cdd793e876c0c34ff4b5cf338977</hash></file>
<file><path>C:\Users\Heinz\AppData\Local\Temp\Desk365\eInstall\image\default\pic-info.png</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>2160cdd793e876c0c34ff4b5cf338977</hash></file>
<file><path>C:\Users\Heinz\AppData\Local\Temp\Desk365\eInstall\image\default\pic-question.png</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>2160cdd793e876c0c34ff4b5cf338977</hash></file>
<file><path>C:\Users\Heinz\AppData\Local\Temp\Desk365\eInstall\image\default\pic-warning.png</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>2160cdd793e876c0c34ff4b5cf338977</hash></file>
<file><path>C:\Users\Heinz\AppData\Local\Temp\Desk365\eInstall\image\default\popup_dialog_bk.png</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>2160cdd793e876c0c34ff4b5cf338977</hash></file>
<file><path>C:\Users\Heinz\AppData\Local\Temp\Desk365\eInstall\image\default\progressbar_bk.png</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>2160cdd793e876c0c34ff4b5cf338977</hash></file>
<file><path>C:\Users\Heinz\AppData\Local\Temp\Desk365\eInstall\image\default\progressbar_image.png</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>2160cdd793e876c0c34ff4b5cf338977</hash></file>
<file><path>C:\Users\Heinz\AppData\Local\Temp\Desk365\eInstall\image\default\radio_normal.png</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>2160cdd793e876c0c34ff4b5cf338977</hash></file>
<file><path>C:\Users\Heinz\AppData\Local\Temp\Desk365\eInstall\image\default\radio_selected.png</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>2160cdd793e876c0c34ff4b5cf338977</hash></file>
<file><path>C:\Users\Heinz\AppData\Local\Temp\Desk365\eInstall\image\default\sys_close.png</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>2160cdd793e876c0c34ff4b5cf338977</hash></file>
<file><path>C:\Users\Heinz\AppData\Local\Temp\Desk365\eInstall\Install\AirZip.inst</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>2160cdd793e876c0c34ff4b5cf338977</hash></file>
<file><path>C:\Users\Heinz\AppData\Local\Temp\Desk365\eInstall\Install\edesk.inst</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>2160cdd793e876c0c34ff4b5cf338977</hash></file>
<file><path>C:\Users\Heinz\AppData\Local\Temp\Desk365\eInstall\Install\gamelogin.inst</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>2160cdd793e876c0c34ff4b5cf338977</hash></file>
<file><path>C:\Users\Heinz\AppData\Local\Temp\Desk365\eInstall\language\protocol.txt</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>2160cdd793e876c0c34ff4b5cf338977</hash></file>
<file><path>C:\Users\Heinz\AppData\Local\Temp\Desk365\eInstall\language\en_us\install_lang.ini</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>2160cdd793e876c0c34ff4b5cf338977</hash></file>
<file><path>C:\Users\Heinz\AppData\Local\Temp\Desk365\eInstall\language\es_es\install_lang.ini</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>2160cdd793e876c0c34ff4b5cf338977</hash></file>
<file><path>C:\Users\Heinz\AppData\Local\Temp\Desk365\eInstall\language\pt_br\install_lang.ini</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>2160cdd793e876c0c34ff4b5cf338977</hash></file>
<file><path>C:\Users\Heinz\AppData\Local\Temp\Desk365\eInstall\language\tr_tr\install_lang.ini</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>2160cdd793e876c0c34ff4b5cf338977</hash></file>
<file><path>C:\Users\Heinz\AppData\Local\Temp\Desk365\eInstall\layout\default\eDeskInstall.xml</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>2160cdd793e876c0c34ff4b5cf338977</hash></file>
<file><path>C:\Users\Heinz\AppData\Local\Temp\Desk365\eInstall\layout\default\gamelogin.xml</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>2160cdd793e876c0c34ff4b5cf338977</hash></file>
<file><path>C:\Users\Heinz\AppData\Local\Temp\Desk365\eInstall\layout\default\install_msgbox.xml</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>2160cdd793e876c0c34ff4b5cf338977</hash></file>
<file><path>C:\Users\Heinz\AppData\Local\Temp\Desk365\eInstall\layout\default\languageSelect.xml</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>2160cdd793e876c0c34ff4b5cf338977</hash></file>
<file><path>C:\Users\Heinz\AppData\Local\Temp\Desk365\eInstall\layout\default\uninstgl.xml</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>2160cdd793e876c0c34ff4b5cf338977</hash></file>
<file><path>C:\Users\Heinz\AppData\Local\Temp\Desk365\eInstall\style\install_style.xml</path><vendor>PUP.Optional.Desk365.A</vendor><action>success</action><hash>2160cdd793e876c0c34ff4b5cf338977</hash></file>
<file><path>C:\Program Files (x86)\Common Files\337\libcef\1.1364.1123\icudt.dll</path><vendor>PUP.Optional.337Technologies.A</vendor><action>success</action><hash>b3ce3a6a403bf4423adb86230ff312ee</hash></file>
<file><path>C:\Program Files (x86)\Common Files\337\libcef\1.1364.1123\libcef.dll</path><vendor>PUP.Optional.337Technologies.A</vendor><action>success</action><hash>b3ce3a6a403bf4423adb86230ff312ee</hash></file>
<file><path>C:\Program Files (x86)\Common Files\337\libcef\1.1364.1123\locales\en-US.pak</path><vendor>PUP.Optional.337Technologies.A</vendor><action>success</action><hash>b3ce3a6a403bf4423adb86230ff312ee</hash></file>
<file><path>C:\Users\Heinz\AppData\Local\Pay-By-Ads\Yahoo! Search\1.3.8.2\app.ini</path><vendor>PUP.Optional.PayByAds.A</vendor><action>success</action><hash>f48dcdd766154beb27c2cdf319e9c33d</hash></file>
<file><path>C:\Users\Heinz\AppData\Local\Pay-By-Ads\Yahoo! Search\1.3.8.2\chrmXtn.dll</path><vendor>PUP.Optional.PayByAds.A</vendor><action>success</action><hash>f48dcdd766154beb27c2cdf319e9c33d</hash></file>
<file><path>C:\Users\Heinz\AppData\Local\Pay-By-Ads\Yahoo! Search\1.3.8.2\ffxtn.dll</path><vendor>PUP.Optional.PayByAds.A</vendor><action>success</action><hash>f48dcdd766154beb27c2cdf319e9c33d</hash></file>
<file><path>C:\Users\Heinz\AppData\Local\Pay-By-Ads\Yahoo! Search\1.3.8.2\ieds.xml</path><vendor>PUP.Optional.PayByAds.A</vendor><action>success</action><hash>f48dcdd766154beb27c2cdf319e9c33d</hash></file>
<file><path>C:\Users\Heinz\AppData\Local\Pay-By-Ads\Yahoo! Search\1.3.8.2\rvt.js</path><vendor>PUP.Optional.PayByAds.A</vendor><action>success</action><hash>f48dcdd766154beb27c2cdf319e9c33d</hash></file>
<file><path>C:\Users\Heinz\AppData\Local\Pay-By-Ads\Yahoo! Search\1.3.8.2\serp.js</path><vendor>PUP.Optional.PayByAds.A</vendor><action>success</action><hash>f48dcdd766154beb27c2cdf319e9c33d</hash></file>
<file><path>C:\Users\Heinz\AppData\Local\Pay-By-Ads\Yahoo! Search\1.3.8.2\sqlite.dll</path><vendor>PUP.Optional.PayByAds.A</vendor><action>delete-on-reboot</action><hash>f48dcdd766154beb27c2cdf319e9c33d</hash></file>
</items>
</mbam-log>

Ich hätte jetzt gerne noch einen Antivirus Pro Log gepostet, dann wäre der Beitrag aber zu lang. Wenn gewollt, kann ich ihn zu einem späteren Zeitpunkt posten.

Ich bedanke mich im Voraus und entschuldige mich schon mal für die Form dieses Beitrages.

LG

schrauber · 28.07.2014, 11:06

hi,

Adware & Co. deinstallieren

Lade Dir bitte von hier Revo Uninstaller herunter.
Installiere und starte das Programm.
Suche im Uninstallerfeld nach den Programmen, die unter:

diesen Zusatz haben:
Wähle die Programme nacheinander aus und klicke jedesmal auf Uninstall.
Wähle anschließend den Modus "Moderat" aus.
Reste löschen:
Klicke auf dann auf und dann auf .

Solltest Du ein Programm nicht finden oder nicht deinstallieren können, mache bitte mit dem nächsten Schritt weiter:

Scan mit Combofix

WARNUNG an die MITLESER:
Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel: Link

WICHTIG: Speichere Combofix auf deinem Desktop.

Deaktiviere bitte alle deine Antivirensoftware sowie Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören. Combofix meckert auch manchmal trotzdem noch, das kannst du dann ignorieren, mir aber bitte mitteilen.

Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.

Während Combofix läuft bitte nicht am Computer arbeiten, die Maus bewegen oder ins Combofixfenster klicken!

Wenn Combofix fertig ist, wird es ein Logfile erstellen.

Bitte poste die C:\Combofix.txt in deiner nächsten Antwort (möglichst in CODE-Tags).

Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
starte den Rechner einfach neu. Dies sollte das Problem beheben.

Fonix · 28.07.2014, 19:04

Hallo,

Ich habe beide Schritte jetzt durchgeführt.

Mit dem Revo Uninstaller konnte ich leider nicht alle Softwares deinstallieren hinter denen Attention stand, weil sie mir im Revo Uninstaller nicht angezeigt wurden.

Combofix habe ich auch durchlaufen lassen, dabei habe ich meiner Meinung nach jedoch einen Fehler gemacht. Sie haben ja geschrieben, dass sich der Log unter C: /Combofix.txt befindet. Deshalb habe ich den Log, der sich nach fertigem Durchlauf geöffnet hat direkt wieder geschlossen um den Log unter C: /Combofix.txt zu kopieren.(Das war eigentlich ziemlich dumm von mir, weil es sich bei beiden um den selben Log handelt). Als ich dann unter C: / nach dem Log gesucht habe, fand ich dort keinen, nur eine andere Datei mit dem Namen Combofix die allerdings nicht auf .txt endete. Wenn ich diese Doppelklickte, kam ich auf die Übersicht "Computer" , wo ich meine Festplatten etc. in der Übersicht hatte. Ich habe nun einfach erneut Combofix durchlaufen lassen und hoffe das war kein Fehler, falls doch tut es mir leid. Nach dem erneuten Durchlauf von Combofix konnte ich nun auch endlich die Combofix.txt unter C: /Combofix.txt finden.

Code:

ATTFilter

ComboFix 14-07-25.01 - Heinz 28.07.2014  19:08:24.3.4 - x64
Microsoft Windows 7 Home Premium   6.1.7601.1.1252.49.1031.18.6048.4129 [GMT 2:00]
ausgeführt von:: c:\users\Heinz\Documents\TBoard\ComboFix.exe
AV: Avira Desktop *Disabled/Updated* {4D041356-F94D-285F-8768-AAE50FA36859}
SP: Avira Desktop *Disabled/Updated* {F665F2B2-DF77-27D1-BDD8-9197742422E4}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\msvcr71.dll
.
.
(((((((((((((((((((((((   Dateien erstellt von 2014-06-28 bis 2014-07-28  ))))))))))))))))))))))))))))))
.
.
2014-07-28 17:12 . 2014-07-28 17:12	--------	d-----w-	c:\users\Default\AppData\Local\temp
2014-07-28 17:07 . 2014-07-28 17:07	75888	----a-w-	c:\programdata\Microsoft\Windows Defender\Definition Updates\{5BDA6FA3-1D0D-43FC-9160-2508DD1DA4D6}\offreg.dll
2014-07-28 15:24 . 2014-07-28 15:24	--------	d-----w-	c:\program files (x86)\VS Revo Group
2014-07-27 21:39 . 2014-07-27 21:50	--------	d-----w-	C:\FRST
2014-07-25 15:29 . 2014-07-02 03:09	10924376	----a-w-	c:\programdata\Microsoft\Windows Defender\Definition Updates\{5BDA6FA3-1D0D-43FC-9160-2508DD1DA4D6}\mpengine.dll
2014-07-14 13:19 . 2014-06-03 10:02	1719296	----a-w-	c:\program files\Windows Journal\NBDoc.DLL
2014-07-14 13:15 . 2014-06-05 14:45	1460736	----a-w-	c:\windows\system32\lsasrv.dll
2014-07-14 13:15 . 2014-06-05 14:26	22016	----a-w-	c:\windows\SysWow64\secur32.dll
2014-07-14 13:15 . 2014-06-05 14:25	96768	----a-w-	c:\windows\SysWow64\sspicli.dll
2014-07-05 14:43 . 2014-07-05 14:43	--------	d-----w-	c:\users\Heinz\AppData\Local\Adobe
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-07-28 16:35 . 2012-07-30 15:34	387	----a-w-	c:\users\Heinz\AppData\Roaming\sp_data.sys
2014-07-28 15:30 . 2014-06-08 15:41	122584	----a-w-	c:\windows\system32\drivers\MBAMSwissArmy.sys
2014-07-24 13:29 . 2013-05-09 14:36	42040	----a-w-	c:\windows\system32\drivers\avnetflt.sys
2014-07-14 13:42 . 2012-08-26 14:43	96441528	----a-w-	c:\windows\system32\MRT.exe
2014-07-10 14:29 . 2013-03-31 13:16	699056	----a-w-	c:\windows\SysWow64\FlashPlayerApp.exe
2014-07-10 14:29 . 2013-03-31 13:16	71344	----a-w-	c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2014-07-05 14:12 . 2013-04-15 12:42	117712	----a-w-	c:\windows\system32\drivers\avgntflt.sys
2014-06-23 14:05 . 2013-04-15 12:42	130584	----a-w-	c:\windows\system32\drivers\avipbb.sys
2014-05-12 05:26 . 2014-06-08 15:40	63704	----a-w-	c:\windows\system32\drivers\mwac.sys
2014-05-12 05:26 . 2014-06-08 15:40	91352	----a-w-	c:\windows\system32\drivers\mbamchameleon.sys
2014-05-12 05:25 . 2014-06-08 15:40	25816	----a-w-	c:\windows\system32\drivers\mbam.sys
2014-05-02 02:37 . 2014-06-23 14:14	116736	----a-w-	c:\windows\system32\drivers\UMDF\WUDFUsbccidDriver.dll
.
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-11-21 959904]
"ASUSPRP"="c:\program files (x86)\ASUS\APRP\APRP.EXE" [2012-02-24 3331312]
"ASUSWebStorage"="c:\program files (x86)\ASUS\ASUS WebStorage\3.0.108.222\AsusWSPanel.exe" [2011-07-29 737104]
"SonicMasterTray"="c:\program files (x86)\ASUS\Sonic Focus\SonicFocusTray.exe" [2010-07-10 984400]
"ATKOSD2"="c:\program files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe" [2011-12-23 318080]
"ATKMEDIA"="c:\program files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe" [2011-10-25 174720]
"HControlUser"="c:\program files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe" [2009-06-19 105016]
"Wireless Console 3"="c:\program files (x86)\ASUS\Wireless Console 3\wcourier.exe" [2011-10-19 2319536]
"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2014-07-05 750160]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
AsusVibeLauncher.lnk - c:\program files (x86)\ASUS\AsusVibe\AsusVibeLauncher.exe /start [2012-2-24 549040]
FancyStart daemon.lnk - c:\windows\Installer\{C944B4C5-1C4D-4D95-8AC0-7CEF13914131}\_77B5857C27147149171BE7.exe -d [2012-5-22 12862]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"Userinit"="userinit.exe"
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 MBAMScheduler;MBAMScheduler;c:\program files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe;c:\program files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe [x]
R2 MBAMService;MBAMService;c:\program files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe;c:\program files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [x]
R3 AmUStor;AM USB Stroage Driver;c:\windows\system32\drivers\AmUStor.SYS;c:\windows\SYSNATIVE\drivers\AmUStor.SYS [x]
R3 cfwids;McAfee Inc. cfwids;c:\windows\system32\drivers\cfwids.sys;c:\windows\SYSNATIVE\drivers\cfwids.sys [x]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys;c:\windows\SYSNATIVE\drivers\mbam.sys [x]
R3 MBAMWebAccessControl;MBAMWebAccessControl;c:\windows\system32\drivers\mwac.sys;c:\windows\SYSNATIVE\drivers\mwac.sys [x]
R3 mferkdet;McAfee Inc. mferkdet;c:\windows\system32\drivers\mferkdet.sys;c:\windows\SYSNATIVE\drivers\mferkdet.sys [x]
R3 SiSGbeLH;SiS191/SiS190 Ethernet Device NDIS 6.0 Driver;c:\windows\system32\DRIVERS\SiSG664.sys;c:\windows\SYSNATIVE\DRIVERS\SiSG664.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe;c:\program files\Windows Live\Mesh\wlcrasvc.exe [x]
S0 mfewfpk;McAfee Inc. mfewfpk;c:\windows\system32\drivers\mfewfpk.sys;c:\windows\SYSNATIVE\drivers\mfewfpk.sys [x]
S1 ATKWMIACPIIO;ATKWMIACPI Driver;c:\program files (x86)\ASUS\ATK Package\ATK WMIACPI\atkwmiacpi64.sys;c:\program files (x86)\ASUS\ATK Package\ATK WMIACPI\atkwmiacpi64.sys [x]
S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys;c:\windows\SYSNATIVE\DRIVERS\avkmgr.sys [x]
S1 mfenlfk;McAfee NDIS Light Filter;c:\windows\system32\DRIVERS\mfenlfk.sys;c:\windows\SYSNATIVE\DRIVERS\mfenlfk.sys [x]
S2 AFBAgent;AFBAgent;c:\windows\system32\FBAgent.exe;c:\windows\SYSNATIVE\FBAgent.exe [x]
S2 AntiVirMailService;Avira Email Schutz;c:\program files (x86)\Avira\AntiVir Desktop\avmailc.exe;c:\program files (x86)\Avira\AntiVir Desktop\avmailc.exe [x]
S2 AntiVirSchedulerService;Avira Planer;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [x]
S2 AntiVirWebService;Avira Browser-Schutz;c:\program files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE;c:\program files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [x]
S2 ASMMAP64;ASMMAP64;c:\program files (x86)\ASUS\ATK Package\ATKGFNEX\ASMMAP64.sys;c:\program files (x86)\ASUS\ATK Package\ATKGFNEX\ASMMAP64.sys [x]
S2 ASUS InstantOn;ASUS InstantOn Service;c:\program files (x86)\ASUS\InstantOn for NB\InsOnSrv.exe;c:\program files (x86)\ASUS\InstantOn for NB\InsOnSrv.exe [x]
S2 cvhsvc;Client Virtualization Handler;c:\program files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE;c:\program files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE [x]
S2 mfefire;McAfee Firewall Core Service;c:\program files\Common Files\McAfee\SystemCore\\mfefire.exe;c:\program files\Common Files\McAfee\SystemCore\\mfefire.exe [x]
S2 mfevtp;McAfee Validation Trust Protection Service;c:\windows\system32\mfevtps.exe;c:\windows\SYSNATIVE\mfevtps.exe [x]
S2 sftlist;Application Virtualization Client;c:\program files (x86)\Microsoft Application Virtualization Client\sftlist.exe;c:\program files (x86)\Microsoft Application Virtualization Client\sftlist.exe [x]
S2 UNS;Intel(R) Management and Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [x]
S3 asmthub3;ASMedia USB3 Hub Service;c:\windows\system32\DRIVERS\asmthub3.sys;c:\windows\SYSNATIVE\DRIVERS\asmthub3.sys [x]
S3 asmtxhci;ASMEDIA XHCI Service;c:\windows\system32\DRIVERS\asmtxhci.sys;c:\windows\SYSNATIVE\DRIVERS\asmtxhci.sys [x]
S3 IntcDAud;Intel(R) Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys;c:\windows\SYSNATIVE\DRIVERS\IntcDAud.sys [x]
S3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller;c:\windows\system32\DRIVERS\L1C62x64.sys;c:\windows\SYSNATIVE\DRIVERS\L1C62x64.sys [x]
S3 mfefirek;McAfee Inc. mfefirek;c:\windows\system32\drivers\mfefirek.sys;c:\windows\SYSNATIVE\drivers\mfefirek.sys [x]
S3 netr28x;Ralink 802.11n Extensible Wireless Driver;c:\windows\system32\DRIVERS\netr28x.sys;c:\windows\SYSNATIVE\DRIVERS\netr28x.sys [x]
S3 Sftfs;Sftfs;c:\windows\system32\DRIVERS\Sftfslh.sys;c:\windows\SYSNATIVE\DRIVERS\Sftfslh.sys [x]
S3 Sftplay;Sftplay;c:\windows\system32\DRIVERS\Sftplaylh.sys;c:\windows\SYSNATIVE\DRIVERS\Sftplaylh.sys [x]
S3 Sftredir;Sftredir;c:\windows\system32\DRIVERS\Sftredirlh.sys;c:\windows\SYSNATIVE\DRIVERS\Sftredirlh.sys [x]
S3 Sftvol;Sftvol;c:\windows\system32\DRIVERS\Sftvollh.sys;c:\windows\SYSNATIVE\DRIVERS\Sftvollh.sys [x]
S3 sftvsa;Application Virtualization Service Agent;c:\program files (x86)\Microsoft Application Virtualization Client\sftvsa.exe;c:\program files (x86)\Microsoft Application Virtualization Client\sftvsa.exe [x]
.
.
Inhalt des "geplante Tasks" Ordners
.
2014-07-28 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-03-31 14:29]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\AsusWSShellExt_B]
@="{6D4133E5-0742-4ADC-8A8C-9303440F7190}"
[HKEY_CLASSES_ROOT\CLSID\{6D4133E5-0742-4ADC-8A8C-9303440F7190}]
2011-05-25 07:09	227840	----a-w-	c:\program files (x86)\ASUS\ASUS WebStorage\3.0.108.222\AsusWSShellExt64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\AsusWSShellExt_O]
@="{64174815-8D98-4CE6-8646-4C039977D808}"
[HKEY_CLASSES_ROOT\CLSID\{64174815-8D98-4CE6-8646-4C039977D808}]
2011-05-25 07:09	227840	----a-w-	c:\program files (x86)\ASUS\ASUS WebStorage\3.0.108.222\AsusWSShellExt64.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2011-11-03 167704]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2011-11-03 392472]
"SynTPEnh"="c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe" [BU]
"AmIcoSinglun64"="c:\program files (x86)\AmIcoSingLun\AmIcoSinglun64.exe" [2011-03-21 361984]
"SynAsusAcpi"="c:\program files (x86)\Synaptics\SynTP\SynAsusAcpi.exe" [BU]
"RtHDVBg"="c:\program files\Realtek\Audio\HDA\RAVBg64.exe" [2011-08-16 2277480]
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://rts.dsrlte.com
mLocal Page = c:\windows\SysWOW64\blank.htm
LSP: c:\program files (x86)\Avira\AntiVir Desktop\avsda.dll
TCP: DhcpNameServer = 192.168.178.1
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Toolbar-Locked - (no file)
AddRemove-ASUS_Screensaver - c:\windows\system32\ASUS_Screensaver.scr
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2014-07-28  19:13:22
ComboFix-quarantined-files.txt  2014-07-28 17:13
ComboFix2.txt  2014-07-28 17:03
.
Vor Suchlauf: 16 Verzeichnis(se), 145.360.965.632 Bytes frei
Nach Suchlauf: 17 Verzeichnis(se), 145.291.276.288 Bytes frei
.
- - End Of File - - 5DE1ED08973D969F6B9A2F080D9C87B4

schrauber · 29.07.2014, 10:19

Downloade Dir bitte

Malwarebytes Anti-Malware

Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
Starte Malwarebytes' Anti-Malware (MBAM).
Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.

Downloade Dir bitte

AdwCleaner auf deinen Desktop.

Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
Starte die AdwCleaner.exe mit einem Doppelklick.
Stimme den Nutzungsbedingungen zu.
Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
- "Tracing" Schlüssel löschen
- Winsock Einstellungen zurücksetzen
- Proxy Einstellungen zurücksetzen
- Internet Explorer Richtlinien zurücksetzen
- Chrome Richtlinien zurücksetzen
- Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
Drücke eine beliebige Taste, um das Tool zu starten.
Je nach System kann der Scan eine Weile dauern.
Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.

und ein frisches FRST log bitte.

Fonix · 29.07.2014, 12:24

MBAM Log:

Code:

ATTFilter

 Malwarebytes Anti-Malware 
www.malwarebytes.org

Suchlauf Datum: 29.07.2014
Suchlauf-Zeit: 12:23:48
Logdatei: mbamneu.txt
Administrator: Ja

Version: 2.00.2.1012
Malware Datenbank: v2014.07.29.02
Rootkit Datenbank: v2014.07.17.01
Lizenz: Kostenlos
Malware Schutz: Deaktiviert
Bösartiger Webseiten Schutz: Deaktiviert
Self-protection: Deaktiviert

Betriebssystem: Windows 7 Service Pack 1
CPU: x64
Dateisystem: NTFS
Benutzer: Heinz

Suchlauf-Art: Bedrohungs-Suchlauf
Ergebnis: Abgeschlossen
Durchsuchte Objekte: 294866
Verstrichene Zeit: 17 Min, 22 Sek

Speicher: Aktiviert
Autostart: Aktiviert
Dateisystem: Aktiviert
Archive: Aktiviert
Rootkits: Deaktiviert
Heuristics: Aktiviert
PUP: Aktiviert
PUM: Aktiviert

Prozesse: 0
(No malicious items detected)

Module: 0
(No malicious items detected)

Registrierungsschlüssel: 0
(No malicious items detected)

Registrierungswerte: 0
(No malicious items detected)

Registrierungsdaten: 0
(No malicious items detected)

Ordner: 0
(No malicious items detected)

Dateien: 0
(No malicious items detected)

Physische Sektoren: 0
(No malicious items detected)


(end)

AdwCleaner Log:

Code:

ATTFilter

# AdwCleaner v3.301 - Bericht erstellt am 29/07/2014 um 12:48:58
# Aktualisiert 28/07/2014 von Xplode
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)
# Benutzername : Heinz - HEINZ-PC
# Gestartet von : C:\Users\Heinz\Downloads\adwcleaner_3.301.exe
# Option : Löschen

***** [ Dienste ] *****


***** [ Dateien / Ordner ] *****

Ordner Gelöscht : C:\ProgramData\Babylon
Ordner Gelöscht : C:\ProgramData\eSafe
Ordner Gelöscht : C:\ProgramData\Tarma Installer
Ordner Gelöscht : C:\ProgramData\Uniblue
Ordner Gelöscht : C:\Program Files (x86)\Iminent
Ordner Gelöscht : C:\Program Files (x86)\MyPC Backup
Ordner Gelöscht : C:\Program Files (x86)\pc speed up
Ordner Gelöscht : C:\Program Files (x86)\WebConnect
Ordner Gelöscht : C:\Program Files (x86)\Common Files\337
Ordner Gelöscht : C:\Users\Heinz\AppData\Local\Babylon
Ordner Gelöscht : C:\Users\Heinz\AppData\LocalLow\Delta
Ordner Gelöscht : C:\Users\Heinz\AppData\Roaming\Babylon

***** [ Tasks ] *****

Task Gelöscht : Desk 365 RunAsStdUser
Task Gelöscht : Omiga Plus RunAsStdUser

***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****

Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\DOMStorage\webconnect.co
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\driverscanner
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Prod.cap
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\au__rasapi32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\au__rasmancs
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\AutoLyricsUpdater_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\AutoLyricsUpdater_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\BabMaint_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\BabMaint_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\BingBar_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\driverscanner_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\driverscanner_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\Iminent_nonsearch_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\Iminent_nonsearch_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\Iminent_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\Iminent_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\MyBabylontb_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\MyBabylontb_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftwareUpdater_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftwareUpdater_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\updateWebConnect_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\updateWebConnect_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\WebCakeDesktop_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\WebCakeDesktop_RASMANCS
Schlüssel Gelöscht : HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Application\DeskSvc
Schlüssel Gelöscht : HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Application\omigaplussvc
Schlüssel Gelöscht : HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Application\WsysSvc
Schlüssel Gelöscht : HKLM\SOFTWARE\5b6d68ce06ebe41
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_apache-openoffice_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_apache-openoffice_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{BDB69379-802F-4EAF-B541-F8DE92DD98DB}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{02054E11-5113-4BE3-8153-AA8DFB5D3761}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{1AA60054-57D9-4F99-9A55-D0FBFBE7ECD3}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{5A4E3A41-FA55-4BDA-AED7-CEBE6E7BCB52}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{FB684D26-01F4-4D9D-87CB-F486BEBA56DC}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{021B4049-F57D-4565-A693-FD3B04786BFA}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{0362AA09-808D-48E9-B360-FB51A8CBCE09}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{06844020-CD0B-3D3D-A7FE-371153013E49}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{0ADC01BB-303B-3F8E-93DA-12C140E85460}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{0AFD55C8-ADF8-4A33-A6E1-DEDB7A36AEB4}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{10D3722F-23E6-3901-B6C1-FF6567121920}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{1675E62B-F911-3B7B-A046-EB57261212F3}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{192929F2-9273-3894-91B0-F54671C4C861}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{2932897E-3036-43D9-8A64-B06447992065}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{2DE92D29-A042-3C37-BFF8-07C7D8893EFA}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{32B80AD6-1214-45F4-994E-78A5D482C000}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{3A8E103F-B2B7-3BEF-B3B0-88E29B2420E4}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{478CE5D3-D38E-3FFE-8DBE-8C4A0F1C4D8D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{48B7DA4E-69ED-39E3-BAD5-3E3EFF22CFB0}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{4E6354DE-9115-4AEE-BD21-C46C3E8A49DB}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{5982F405-44E4-3BBB-BAC4-CF8141CBBC5C}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{5D8C3CC3-3C05-38A1-B244-924A23115FE9}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{641593AF-D9FD-30F7-B783-36E16F7A2E08}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{711FC48A-1356-3932-94D8-A8B733DBC7E4}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{72227B7F-1F02-3560-95F5-592E68BACC0C}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{7B5E8CE3-4722-4C0E-A236-A6FF731BEF37}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{890D4F59-5ED0-3CB4-8E0E-74A5A86E7ED0}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{8C68913C-AC3C-4494-8B9C-984D87C85003}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{8D019513-083F-4AA5-933F-7D43A6DA82C4}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{923F6FB8-A390-370E-A0D2-DD505432481D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{9BBB26EF-B178-35D6-9D3D-B485F4279FE5}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{A62DDBE0-8D2A-339A-B089-8CBCC5CD322A}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{A82AD04D-0B8E-3A49-947B-6A69A8A9C96D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{ADEB3CC9-A05D-4FCC-BD09-9025456AA3EA}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{B06D4521-D09C-3F41-8E39-9D784CCA2A75}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{C06DAD42-6F39-4CE1-83CC-9A8B9105E556}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{C2E799D0-43A5-3477-8A98-FC5F3677F35C}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{D16107CD-2AD5-46A8-BA59-303B7C32C500}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{D25B101F-8188-3B43-9D85-201F372BC205}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{D2BA7595-5E44-3F1E-880F-03B3139FA5ED}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{D35F5C81-17D9-3E1C-A1FC-4472542E1D25}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{D8FA96CA-B250-312C-AF34-4FF1DD72589D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{DAFC1E63-3359-416D-9BC2-E7DCA6F7B0F3}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{DC5E5C44-80FD-3697-9E65-9F286D92F3E7}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{E1B4C9DE-D741-385F-981E-6745FACE6F01}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{E7B623F5-9715-3F9F-A671-D1485A39F8A2}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{ED916A7B-7C68-3198-B87D-2DABC30A5587}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{EFA1BDB2-BB3D-3D9A-8EB5-D0D22E0F64F4}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{F4CBF4DD-F8FE-35BA-BB7E-68304DAAB70B}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{FC073BDA-C115-4A1D-9DF9-9B5C461482E5}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{FC32005D-E27C-32E0-ADFA-152F598B75E7}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{2BF2028E-3F3C-4C05-AB45-B2F1DCFE0759}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{A2D733A7-73B0-4C6B-B0C7-06A432950B66}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{DB538320-D3C5-433C-BCA9-C4081A054FCF}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{021B4049-F57D-4565-A693-FD3B04786BFA}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{0362AA09-808D-48E9-B360-FB51A8CBCE09}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{06844020-CD0B-3D3D-A7FE-371153013E49}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{0ADC01BB-303B-3F8E-93DA-12C140E85460}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{10D3722F-23E6-3901-B6C1-FF6567121920}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{1675E62B-F911-3B7B-A046-EB57261212F3}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{192929F2-9273-3894-91B0-F54671C4C861}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{2932897E-3036-43D9-8A64-B06447992065}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{2DE92D29-A042-3C37-BFF8-07C7D8893EFA}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{32B80AD6-1214-45F4-994E-78A5D482C000}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{3A8E103F-B2B7-3BEF-B3B0-88E29B2420E4}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{478CE5D3-D38E-3FFE-8DBE-8C4A0F1C4D8D}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{48B7DA4E-69ED-39E3-BAD5-3E3EFF22CFB0}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{4E6354DE-9115-4AEE-BD21-C46C3E8A49DB}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{5982F405-44E4-3BBB-BAC4-CF8141CBBC5C}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{5D8C3CC3-3C05-38A1-B244-924A23115FE9}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{641593AF-D9FD-30F7-B783-36E16F7A2E08}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{711FC48A-1356-3932-94D8-A8B733DBC7E4}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{72227B7F-1F02-3560-95F5-592E68BACC0C}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{7B5E8CE3-4722-4C0E-A236-A6FF731BEF37}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{890D4F59-5ED0-3CB4-8E0E-74A5A86E7ED0}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{8C68913C-AC3C-4494-8B9C-984D87C85003}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{8D019513-083F-4AA5-933F-7D43A6DA82C4}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{923F6FB8-A390-370E-A0D2-DD505432481D}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{9BBB26EF-B178-35D6-9D3D-B485F4279FE5}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{A62DDBE0-8D2A-339A-B089-8CBCC5CD322A}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{A82AD04D-0B8E-3A49-947B-6A69A8A9C96D}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{ADEB3CC9-A05D-4FCC-BD09-9025456AA3EA}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{B06D4521-D09C-3F41-8E39-9D784CCA2A75}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{C06DAD42-6F39-4CE1-83CC-9A8B9105E556}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{C2E799D0-43A5-3477-8A98-FC5F3677F35C}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{D16107CD-2AD5-46A8-BA59-303B7C32C500}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{D25B101F-8188-3B43-9D85-201F372BC205}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{D2BA7595-5E44-3F1E-880F-03B3139FA5ED}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{D35F5C81-17D9-3E1C-A1FC-4472542E1D25}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{D8FA96CA-B250-312C-AF34-4FF1DD72589D}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{DAFC1E63-3359-416D-9BC2-E7DCA6F7B0F3}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{DC5E5C44-80FD-3697-9E65-9F286D92F3E7}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{E1B4C9DE-D741-385F-981E-6745FACE6F01}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{E7B623F5-9715-3F9F-A671-D1485A39F8A2}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{ED916A7B-7C68-3198-B87D-2DABC30A5587}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{EFA1BDB2-BB3D-3D9A-8EB5-D0D22E0F64F4}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{F4CBF4DD-F8FE-35BA-BB7E-68304DAAB70B}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{FC073BDA-C115-4A1D-9DF9-9B5C461482E5}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{FC32005D-E27C-32E0-ADFA-152F598B75E7}
Schlüssel Gelöscht : HKCU\Software\Delta
Schlüssel Gelöscht : HKCU\Software\Optimizer Pro
Schlüssel Gelöscht : HKCU\Software\SecuredDownload
Schlüssel Gelöscht : HKCU\Software\Softonic
Schlüssel Gelöscht : HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\AutoLyrics
Schlüssel Gelöscht : HKLM\Software\{1146AC44-2F03-4431-B4FD-889BC837521F}
Schlüssel Gelöscht : HKLM\Software\{6791A2F3-FC80-475C-A002-C014AF797E9C}
Schlüssel Gelöscht : HKLM\Software\Babylon
Schlüssel Gelöscht : HKLM\Software\Delta
Schlüssel Gelöscht : HKLM\Software\Desksvc
Schlüssel Gelöscht : HKLM\Software\hdcode
Schlüssel Gelöscht : HKLM\Software\omigaplusSvc
Schlüssel Gelöscht : HKLM\Software\Uniblue
Schlüssel Gelöscht : HKLM\Software\V9
Schlüssel Gelöscht : HKLM\Software\Vittalia
Schlüssel Gelöscht : HKLM\Software\WebConnect
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SearchTheWebARP
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Speedchecker Limited
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WebConnect

***** [ Browser ] *****

-\\ Internet Explorer v11.0.9600.17207


-\\ Google Chrome v

[ Datei : C:\Users\Heinz\AppData\Local\Google\Chrome\User Data\Default\preferences ]


*************************

AdwCleaner[R0].txt - [14940 octets] - [29/07/2014 12:47:39]
AdwCleaner[S0].txt - [14315 octets] - [29/07/2014 12:48:58]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [14376 octets] ##########

JRT Log:

Code:

ATTFilter

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.1.4 (04.06.2014:1)
OS: Windows 7 Home Premium x64
Ran by Heinz on 29.07.2014 at 12:55:49,98
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CLSID\{FB684D26-01F4-4D9D-87CB-F486BEBA56DC}
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-3534363647-1427521627-2892733247-1000\Software\sweetim
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\pricepeep_RASAPI32
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\pricepeep_RASMANCS
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Tracing\pricepeep_RASAPI32
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Tracing\pricepeep_RASMANCS



~~~ Files



~~~ Folders

Successfully deleted: [Empty Folder] C:\Users\Heinz\appdata\local\{038FC757-D5EE-47E7-B310-F34A7F058797}
Successfully deleted: [Empty Folder] C:\Users\Heinz\appdata\local\{0D15C0EA-98AC-42A6-9009-BF57388E1519}
Successfully deleted: [Empty Folder] C:\Users\Heinz\appdata\local\{0EE812C6-5800-40F5-AF37-FDB6ED35077F}
Successfully deleted: [Empty Folder] C:\Users\Heinz\appdata\local\{14CACDC4-1CD4-4F5F-8CFF-2F38816CDD0D}
Successfully deleted: [Empty Folder] C:\Users\Heinz\appdata\local\{26F42EFC-A32A-4AB3-9A8C-A326EB5EBCE9}
Successfully deleted: [Empty Folder] C:\Users\Heinz\appdata\local\{2ED8CF1C-1E5F-48CC-841C-99F35B0ECB98}
Successfully deleted: [Empty Folder] C:\Users\Heinz\appdata\local\{3B15AE0C-A429-4E5F-94E9-30A592D41594}
Successfully deleted: [Empty Folder] C:\Users\Heinz\appdata\local\{427EE58B-9F1F-4559-88C7-335008C30BD2}
Successfully deleted: [Empty Folder] C:\Users\Heinz\appdata\local\{53A0CF1A-A1E8-4D2D-8172-F55FC00ADBCF}
Successfully deleted: [Empty Folder] C:\Users\Heinz\appdata\local\{56D588CC-ECAB-4C3D-87EC-8D870A9F6B78}
Successfully deleted: [Empty Folder] C:\Users\Heinz\appdata\local\{B141BBE7-2888-4491-B5B2-4B5D7D56AE40}
Successfully deleted: [Empty Folder] C:\Users\Heinz\appdata\local\{D214E337-5877-4D65-8FD1-BCF0CF3DA46B}
Successfully deleted: [Empty Folder] C:\Users\Heinz\appdata\local\{E39A4B40-00C1-4C31-915C-87494D23747A}
Successfully deleted: [Empty Folder] C:\Users\Heinz\appdata\local\{E5ACFB99-EE5B-4C84-BD31-D52237952B29}
Successfully deleted: [Empty Folder] C:\Users\Heinz\appdata\local\{ECE9D21D-83AE-4431-9F5B-DC5AFD5A66D9}
Successfully deleted: [Empty Folder] C:\Users\Heinz\appdata\local\{F94193FF-9C7A-4A44-8570-E4AA5B570FFA}



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 29.07.2014 at 13:13:41,39
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

FRST Log:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 26-07-2014
Ran by Heinz (administrator) on HEINZ-PC on 29-07-2014 13:16:33
Running from C:\Users\Heinz\Documents\TBoard
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal



==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(ASUSTeK Computer Inc.) C:\Windows\System32\FBAgent.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\AsLdrSrv.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(ASUS) C:\Program Files (x86)\ASUS\InstantOn for NB\InsOnSrv.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe
(McAfee, Inc.) C:\Windows\System32\mfevtps.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(McAfee, Inc.) C:\Program Files\Common Files\mcafee\systemcore\mcshield.exe
(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe
(ASUS) C:\Program Files (x86)\ASUS\InstantOn for NB\InsOnWMI.exe
(ASUS) C:\Program Files\ASUS\P4G\BatteryLife.exe
(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\FaceLogon\sensorsrv.exe
(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(McAfee, Inc.) C:\Program Files\Common Files\mcafee\systemcore\mfefire.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Alcor Micro Corp.) C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Virage Logic Corporation / Sonic Focus) C:\Program Files (x86)\ASUS\Sonic Focus\SonicFocusTray.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ATKOSD.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\KBFiltr.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\WDC.exe
(ASUS) C:\Program Files (x86)\ASUS\Splendid\ACMON.exe
(ASUS) C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Microsoft Corporation) C:\Program Files (x86)\Common Files\microsoft shared\Virtualization Handler\CVHSVC.EXE
(ASUS) C:\Windows\AsScrPro.exe
(CyberLink) C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe
(ASUSTeK) C:\Windows\SysWOW64\ACEngSvr.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avwebgrd.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2785064 2011-05-05] (Synaptics Incorporated)
HKLM\...\Run: [AmIcoSinglun64] => C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe [361984 2011-03-21] (Alcor Micro Corp.)
HKLM\...\Run: [SynAsusAcpi] => C:\Program Files\Synaptics\SynTP\SynAsusAcpi.exe [97064 2011-05-05] (Synaptics Incorporated)
HKLM\...\Run: [RtHDVBg] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [2277480 2011-08-16] (Realtek Semiconductor)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [ASUSPRP] => C:\Program Files (x86)\ASUS\APRP\APRP.EXE [3331312 2012-02-24] (ASUSTek Computer Inc.)
HKLM-x32\...\Run: [ASUSWebStorage] => C:\Program Files (x86)\ASUS\ASUS WebStorage\3.0.108.222\AsusWSPanel.exe [737104 2011-07-29] (ecareme)
HKLM-x32\...\Run: [SonicMasterTray] => C:\Program Files (x86)\ASUS\Sonic Focus\SonicFocusTray.exe [984400 2010-07-10] (Virage Logic Corporation / Sonic Focus)
HKLM-x32\...\Run: [ATKOSD2] => C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe [318080 2011-12-23] (ASUSTek Computer Inc.)
HKLM-x32\...\Run: [ATKMEDIA] => C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe [174720 2011-10-25] (ASUS)
HKLM-x32\...\Run: [HControlUser] => C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe [105016 2009-06-19] (ASUS)
HKLM-x32\...\Run: [Wireless Console 3] => C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe [2319536 2011-10-19] (ASUS)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [750160 2014-07-05] (Avira Operations GmbH & Co. KG)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\AsusVibeLauncher.lnk
ShortcutTarget: AsusVibeLauncher.lnk -> C:\Program Files (x86)\ASUS\AsusVibe\AsusVibeLauncher.exe (ASUSTeK Computer Inc.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\FancyStart daemon.lnk
ShortcutTarget: FancyStart daemon.lnk -> C:\Windows\Installer\{C944B4C5-1C4D-4D95-8AC0-7CEF13914131}\_77B5857C27147149171BE7.exe ()
ShellIconOverlayIdentifiers: AsusWSShellExt_B -> {6D4133E5-0742-4ADC-8A8C-9303440F7190} => C:\Program Files (x86)\ASUS\ASUS WebStorage\3.0.108.222\ASUSWSShellExt64.dll (eCareme Technologies, Inc.)
ShellIconOverlayIdentifiers: AsusWSShellExt_O -> {64174815-8D98-4CE6-8646-4C039977D808} => C:\Program Files (x86)\ASUS\ASUS WebStorage\3.0.108.222\ASUSWSShellExt64.dll (eCareme Technologies, Inc.)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://rts.dsrlte.com
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKCU - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKCU - {24504368-4233-4638-BB3C-92EC547C805F} URL = hxxp://de.search.yahoo.com/search?fr=mcafee&p={SearchTerms}
SearchScopes: HKCU - {326305B4-41F1-48D5-ADBF-BBAAFE0C6EF9} URL = hxxp://rts.dsrlte.com/?q={searchTerms}&r=97
BHO: scriptproxy -> {7DB2D5A0-7241-4E79-B68D-6309F01C5231} -> C:\Program Files\Common Files\McAfee\SystemCore\ScriptSn.20120806173924.dll (McAfee, Inc.)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: scriptproxy -> {7DB2D5A0-7241-4E79-B68D-6309F01C5231} -> C:\Program Files (x86)\Common Files\McAfee\SystemCore\ScriptSn.20120806173924.dll (McAfee, Inc.)
BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

FireFox:
========
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF32.dll No File
FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3538.0513 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF HKLM-x32\...\Firefox\Extensions: [{D19CA586-DD6C-4a0a-96F8-14644F340D60}] - C:\Program Files (x86)\Common Files\McAfee\SystemCore
FF Extension: No Name - C:\Program Files (x86)\Common Files\McAfee\SystemCore [2012-02-24]

Chrome: 
=======
Error reading preferences. Please check "preferences" file for possible corruption. <======= ATTENTION

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S2 AntiVirMailService; C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc.exe [801872 2014-07-05] (Avira Operations GmbH & Co. KG)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [430160 2014-07-05] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [430160 2014-07-05] (Avira Operations GmbH & Co. KG)
R2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [1028688 2014-07-05] (Avira Operations GmbH & Co. KG)
R2 ASUS InstantOn; C:\Program Files (x86)\ASUS\InstantOn for NB\InsOnSrv.exe [277120 2012-02-17] (ASUS)
R2 MBAMScheduler; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe [1809720 2014-05-12] (Malwarebytes Corporation)
S2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [860472 2014-05-12] (Malwarebytes Corporation)
R2 McShield; C:\Program Files\Common Files\McAfee\SystemCore\\mcshield.exe [199304 2012-05-25] (McAfee, Inc.)
R2 mfefire; C:\Program Files\Common Files\McAfee\SystemCore\\mfefire.exe [210616 2012-05-25] (McAfee, Inc.)
R2 mfevtp; C:\Windows\system32\mfevtps.exe [162224 2012-05-25] (McAfee, Inc.)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [117712 2014-07-05] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [130584 2014-06-23] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-12-08] (Avira Operations GmbH & Co. KG)
S3 cfwids; C:\Windows\System32\drivers\cfwids.sys [65264 2012-02-22] (McAfee, Inc.)
R3 kbfiltr; C:\Windows\System32\DRIVERS\kbfiltr.sys [15416 2009-07-20] ( )
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-05-12] (Malwarebytes Corporation)
S3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [122584 2014-07-29] (Malwarebytes Corporation)
S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2014-05-12] (Malwarebytes Corporation)
R3 mfeapfk; C:\Windows\System32\drivers\mfeapfk.sys [160792 2012-02-22] (McAfee, Inc.)
R3 mfeavfk; C:\Windows\System32\drivers\mfeavfk.sys [229528 2012-02-22] (McAfee, Inc.)
R3 mfefirek; C:\Windows\System32\drivers\mfefirek.sys [487296 2012-02-22] (McAfee, Inc.)
R0 mfehidk; C:\Windows\System32\drivers\mfehidk.sys [647208 2012-02-22] (McAfee, Inc.)
R1 mfenlfk; C:\Windows\System32\DRIVERS\mfenlfk.sys [75936 2012-02-22] (McAfee, Inc.)
S3 mferkdet; C:\Windows\System32\drivers\mferkdet.sys [100912 2012-02-22] (McAfee, Inc.)
R0 mfewfpk; C:\Windows\System32\drivers\mfewfpk.sys [289664 2012-02-22] (McAfee, Inc.)
S3 catchme; \??\C:\ComboFix\catchme.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-07-29 12:55 - 2014-07-29 12:55 - 01016261 _____ (Thisisu) C:\Users\Heinz\Downloads\JRT.exe
2014-07-29 12:55 - 2014-07-29 12:55 - 00000000 ____D () C:\Windows\ERUNT
2014-07-29 12:48 - 2010-08-30 08:34 - 00536576 _____ (SQLite Development Team) C:\Windows\SysWOW64\sqlite3.dll
2014-07-29 12:47 - 2014-07-29 12:49 - 00000000 ____D () C:\AdwCleaner
2014-07-29 12:46 - 2014-07-29 12:46 - 01365525 _____ () C:\Users\Heinz\Downloads\adwcleaner_3.301.exe
2014-07-28 19:13 - 2014-07-28 19:13 - 00012948 _____ () C:\ComboFix.txt
2014-07-28 17:39 - 2011-06-26 08:45 - 00256000 _____ () C:\Windows\PEV.exe
2014-07-28 17:39 - 2010-11-07 19:20 - 00208896 _____ () C:\Windows\MBR.exe
2014-07-28 17:39 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2014-07-28 17:39 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2014-07-28 17:39 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2014-07-28 17:39 - 2000-08-31 02:00 - 00098816 _____ () C:\Windows\sed.exe
2014-07-28 17:39 - 2000-08-31 02:00 - 00080412 _____ () C:\Windows\grep.exe
2014-07-28 17:39 - 2000-08-31 02:00 - 00068096 _____ () C:\Windows\zip.exe
2014-07-28 17:38 - 2014-07-28 19:13 - 00000000 ____D () C:\Qoobox
2014-07-28 17:38 - 2014-07-28 19:01 - 00000000 ____D () C:\Windows\erdnt
2014-07-28 17:24 - 2014-07-28 17:24 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group
2014-07-28 17:23 - 2014-07-28 17:24 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Heinz\Downloads\revosetup95.exe
2014-07-27 23:39 - 2014-07-29 13:16 - 00000000 ____D () C:\FRST
2014-07-27 23:38 - 2014-07-27 23:38 - 00000000 _____ () C:\Users\Heinz\defogger_reenable
2014-07-27 19:11 - 2014-07-27 19:11 - 00072096 _____ () C:\Users\Heinz\AVSCAN-20140727-181902-181264F8.LOG
2014-07-27 18:27 - 2014-07-29 13:16 - 00000000 ____D () C:\Users\Heinz\Documents\TBoard
2014-07-27 18:18 - 2014-07-27 18:18 - 00003532 _____ () C:\Windows\System32\Tasks\Yahoo! Search
2014-07-14 15:20 - 2014-06-20 22:14 - 00266424 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-07-14 15:20 - 2014-06-20 21:39 - 00240824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2014-07-14 15:20 - 2014-06-19 03:39 - 23464448 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-07-14 15:20 - 2014-06-19 03:06 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-07-14 15:20 - 2014-06-19 03:06 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-07-14 15:20 - 2014-06-19 02:48 - 02768384 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-07-14 15:20 - 2014-06-19 02:42 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-07-14 15:20 - 2014-06-19 02:42 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-07-14 15:20 - 2014-06-19 02:41 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2014-07-14 15:20 - 2014-06-19 02:41 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-07-14 15:20 - 2014-06-19 02:32 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-07-14 15:20 - 2014-06-19 02:31 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-07-14 15:20 - 2014-06-19 02:26 - 00598016 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-07-14 15:20 - 2014-06-19 02:24 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-07-14 15:20 - 2014-06-19 02:24 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-07-14 15:20 - 2014-06-19 02:23 - 00752640 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-07-14 15:20 - 2014-06-19 02:16 - 17276416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-07-14 15:20 - 2014-06-19 02:14 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-07-14 15:20 - 2014-06-19 02:09 - 00452608 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-07-14 15:20 - 2014-06-19 01:59 - 00038400 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-07-14 15:20 - 2014-06-19 01:56 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-07-14 15:20 - 2014-06-19 01:53 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-07-14 15:20 - 2014-06-19 01:51 - 05721088 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-07-14 15:20 - 2014-06-19 01:50 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-07-14 15:20 - 2014-06-19 01:48 - 00292864 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-07-14 15:20 - 2014-06-19 01:39 - 00608768 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-07-14 15:20 - 2014-06-19 01:38 - 00455168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-07-14 15:20 - 2014-06-19 01:37 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-07-14 15:20 - 2014-06-19 01:36 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-07-14 15:20 - 2014-06-19 01:35 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2014-07-14 15:20 - 2014-06-19 01:33 - 00631808 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-07-14 15:20 - 2014-06-19 01:32 - 02179072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-07-14 15:20 - 2014-06-19 01:28 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-07-14 15:20 - 2014-06-19 01:28 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-07-14 15:20 - 2014-06-19 01:27 - 02040832 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-07-14 15:20 - 2014-06-19 01:27 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-07-14 15:20 - 2014-06-19 01:25 - 00442368 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-07-14 15:20 - 2014-06-19 01:23 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-07-14 15:20 - 2014-06-19 01:22 - 00592896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-07-14 15:20 - 2014-06-19 01:12 - 00367616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-07-14 15:20 - 2014-06-19 01:06 - 00032256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-07-14 15:20 - 2014-06-19 01:01 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-07-14 15:20 - 2014-06-19 00:59 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-07-14 15:20 - 2014-06-19 00:58 - 02266112 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-07-14 15:20 - 2014-06-19 00:58 - 00239616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-07-14 15:20 - 2014-06-19 00:52 - 04254720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-07-14 15:20 - 2014-06-19 00:51 - 13527040 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-07-14 15:20 - 2014-06-19 00:49 - 00526336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-07-14 15:20 - 2014-06-19 00:46 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2014-07-14 15:20 - 2014-06-19 00:45 - 01964544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-07-14 15:20 - 2014-06-19 00:35 - 11742208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-07-14 15:20 - 2014-06-19 00:34 - 01393664 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-07-14 15:20 - 2014-06-19 00:15 - 00846336 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-07-14 15:20 - 2014-06-19 00:13 - 01791488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-07-14 15:20 - 2014-06-19 00:09 - 01139200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-07-14 15:20 - 2014-06-19 00:07 - 00704512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-07-14 15:19 - 2014-06-30 04:09 - 00519168 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-07-14 15:19 - 2014-06-30 04:04 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-07-14 15:19 - 2014-06-18 04:18 - 00692736 _____ (Microsoft Corporation) C:\Windows\system32\osk.exe
2014-07-14 15:19 - 2014-06-18 03:51 - 00646144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\osk.exe
2014-07-14 15:19 - 2014-06-18 03:10 - 03157504 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-07-14 15:19 - 2014-06-06 12:10 - 00624128 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll
2014-07-14 15:19 - 2014-06-06 11:44 - 00509440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll
2014-07-14 15:19 - 2014-05-30 10:08 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2014-07-14 15:19 - 2014-05-30 10:08 - 00340992 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2014-07-14 15:19 - 2014-05-30 10:08 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2014-07-14 15:19 - 2014-05-30 10:08 - 00307200 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2014-07-14 15:19 - 2014-05-30 10:08 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2014-07-14 15:19 - 2014-05-30 10:08 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2014-07-14 15:19 - 2014-05-30 10:08 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2014-07-14 15:19 - 2014-05-30 09:52 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2014-07-14 15:19 - 2014-05-30 09:52 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2014-07-14 15:19 - 2014-05-30 09:52 - 00247808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2014-07-14 15:19 - 2014-05-30 09:52 - 00220160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2014-07-14 15:19 - 2014-05-30 09:52 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2014-07-14 15:19 - 2014-05-30 09:52 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2014-07-14 15:19 - 2014-05-30 09:52 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2014-07-14 15:19 - 2014-05-30 08:45 - 00497152 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys
2014-07-14 15:15 - 2014-06-05 16:45 - 01460736 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2014-07-14 15:15 - 2014-06-05 16:26 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2014-07-14 15:15 - 2014-06-05 16:25 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2014-07-05 16:43 - 2014-07-05 16:43 - 00000000 ____D () C:\Users\Heinz\AppData\Local\Adobe

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-07-29 13:16 - 2014-07-27 23:39 - 00000000 ____D () C:\FRST
2014-07-29 13:16 - 2014-07-27 18:27 - 00000000 ____D () C:\Users\Heinz\Documents\TBoard
2014-07-29 12:59 - 2009-07-14 06:45 - 00009696 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-07-29 12:59 - 2009-07-14 06:45 - 00009696 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-07-29 12:55 - 2014-07-29 12:55 - 01016261 _____ (Thisisu) C:\Users\Heinz\Downloads\JRT.exe
2014-07-29 12:55 - 2014-07-29 12:55 - 00000000 ____D () C:\Windows\ERUNT
2014-07-29 12:54 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\NDF
2014-07-29 12:51 - 2012-07-30 17:35 - 00000000 ___HD () C:\ASUS.DAT
2014-07-29 12:51 - 2012-07-30 17:34 - 00000387 _____ () C:\Users\Heinz\AppData\Roaming\sp_data.sys
2014-07-29 12:50 - 2012-02-24 03:34 - 00171576 _____ () C:\Windows\PFRO.log
2014-07-29 12:50 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-07-29 12:50 - 2009-07-14 06:51 - 00065933 _____ () C:\Windows\setupact.log
2014-07-29 12:49 - 2014-07-29 12:47 - 00000000 ____D () C:\AdwCleaner
2014-07-29 12:49 - 2012-05-22 14:35 - 01131854 _____ () C:\Windows\WindowsUpdate.log
2014-07-29 12:46 - 2014-07-29 12:46 - 01365525 _____ () C:\Users\Heinz\Downloads\adwcleaner_3.301.exe
2014-07-29 12:28 - 2013-03-31 15:17 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-07-29 12:23 - 2014-06-08 17:41 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-07-28 19:13 - 2014-07-28 19:13 - 00012948 _____ () C:\ComboFix.txt
2014-07-28 19:13 - 2014-07-28 17:38 - 00000000 ____D () C:\Qoobox
2014-07-28 19:12 - 2009-07-14 04:34 - 00000215 _____ () C:\Windows\system.ini
2014-07-28 19:03 - 2009-07-14 05:20 - 00000000 __RHD () C:\Users\Default
2014-07-28 19:01 - 2014-07-28 17:38 - 00000000 ____D () C:\Windows\erdnt
2014-07-28 17:24 - 2014-07-28 17:24 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group
2014-07-28 17:24 - 2014-07-28 17:23 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Heinz\Downloads\revosetup95.exe
2014-07-27 23:38 - 2014-07-27 23:38 - 00000000 _____ () C:\Users\Heinz\defogger_reenable
2014-07-27 23:38 - 2012-07-30 17:34 - 00000000 ____D () C:\Users\Heinz
2014-07-27 19:22 - 2012-08-26 17:32 - 00000000 ____D () C:\Heinz
2014-07-27 19:11 - 2014-07-27 19:11 - 00072096 _____ () C:\Users\Heinz\AVSCAN-20140727-181902-181264F8.LOG
2014-07-27 18:50 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\Resources
2014-07-27 18:22 - 2009-07-14 04:34 - 00000537 _____ () C:\Windows\win.ini
2014-07-27 18:18 - 2014-07-27 18:18 - 00003532 _____ () C:\Windows\System32\Tasks\Yahoo! Search
2014-07-27 17:26 - 2009-07-29 07:20 - 00000000 ____D () C:\Windows\ABLKSR
2014-07-26 16:03 - 2013-03-19 13:51 - 00000000 ____D () C:\Program Files\Microsoft Silverlight
2014-07-26 16:03 - 2013-03-19 13:51 - 00000000 ____D () C:\Program Files (x86)\Microsoft Silverlight
2014-07-26 16:03 - 2009-07-14 07:08 - 00032632 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-07-25 17:28 - 2013-03-19 13:52 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
2014-07-24 15:33 - 2011-02-19 06:24 - 00700118 _____ () C:\Windows\system32\perfh007.dat
2014-07-24 15:33 - 2011-02-19 06:24 - 00149968 _____ () C:\Windows\system32\perfc007.dat
2014-07-24 15:33 - 2009-07-14 07:13 - 01622164 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-07-24 15:29 - 2013-05-09 16:36 - 00042040 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2014-07-24 15:26 - 2009-07-14 06:45 - 00294712 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-07-24 15:23 - 2014-05-12 14:54 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-07-24 15:23 - 2009-07-14 09:45 - 00000000 ____D () C:\Program Files\Windows Journal
2014-07-24 15:23 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\SysWOW64\Dism
2014-07-24 15:23 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\Dism
2014-07-14 15:44 - 2013-08-20 17:05 - 00000000 ____D () C:\Windows\system32\MRT
2014-07-14 15:42 - 2012-08-26 16:43 - 96441528 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-07-10 16:29 - 2013-03-31 15:17 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-07-10 16:29 - 2013-03-31 15:16 - 00699056 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-07-10 16:29 - 2013-03-31 15:16 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-07-07 12:01 - 2009-07-14 07:09 - 00000000 ____D () C:\Windows\System32\Tasks\WPD
2014-07-05 16:43 - 2014-07-05 16:43 - 00000000 ____D () C:\Users\Heinz\AppData\Local\Adobe
2014-07-05 16:12 - 2013-04-15 14:42 - 00117712 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2014-06-30 04:09 - 2014-07-14 15:19 - 00519168 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-06-30 04:04 - 2014-07-14 15:19 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll

Some content of TEMP:
====================
C:\Users\Heinz\AppData\Local\Temp\avgnt.exe
C:\Users\Heinz\AppData\Local\Temp\Quarantine.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2013-08-26 15:37

==================== End Of Log ============================

--- --- ---

schrauber · 29.07.2014, 16:22

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Downloade Dir bitte

SecurityCheck und:

Speichere es auf dem Desktop.
Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.

Poste den Inhalt bitte hier.

und ein frisches FRST log bitte. Noch Probleme?

Fonix · 29.07.2014, 22:02

So ganz durch sind wir glaub ich noch nicht, zumindest sind noch einige Funde angezeigt. Hier einmal die Logs:
ESET:

Code:

ATTFilter

ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=9df7c0979c0a8c4eaf76dc3a3888c26b
# engine=19403
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2014-07-29 06:46:05
# local_time=2014-07-29 08:46:05 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1031
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode_1=''
# compatibility_mode=5893 16776573 100 94 30282 158289415 0 0
# scanned=151983
# found=19
# cleaned=0
# scan_time=3153
sh=3B88B9BD67A6D948F9D70FD055155CA6D3E808D1 ft=1 fh=ca0fa7dbab587652 vn="Variante von MSIL/BrowseFox.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\WebConnect\WebConnect.Common.dll.vir"
sh=730F9280EE160554B003FAFB4EF15EDEE6B63631 ft=1 fh=4462739be70d34ea vn="möglicherweise Variante von MSIL/BrowseFox.G evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\WebConnect\WebConnectUn.exe.vir"
sh=1D7B5FD0A67A70BE93386D553C8623917F63E653 ft=1 fh=688b16a15015434a vn="Win32/BrowseFox.C evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\WebConnect\WebConnectUninstall.exe.vir"
sh=8CDAD0D0592B90D114BC216BF1C76F94AD90D964 ft=1 fh=7669c7140005b246 vn="Variante von Win32/BrowseFox.I evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\WebConnect\bin\WebConnect.BrowserAdapter.exe.vir"
sh=D2D5449315A217A6CD8F59DAB58C37D8BC1D6171 ft=1 fh=653b3460db3632fb vn="Variante von Win64/BrowseFox.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\WebConnect\bin\WebConnect.PurBrowse64.exe.vir"
sh=ADBB99EB344F53A7FEEEB7B2E1EDD0EDF3206A3F ft=1 fh=d238d0ed3ae362cc vn="Variante von Win32/BrowseFox.I evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\WebConnect\bin\WebConnectBAApp.dll.vir"
sh=828753F86A31EBD621875332B4F4B1866258979B ft=1 fh=e49114f9286b08ee vn="Variante von Win32/BrowseFox.K evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\WebConnect\bin\{664f7cae-01d9-48b5-bc90-e3c3d6bb0ddb}.dll.vir"
sh=21BBD779DE8084B94723A6772AF2027E8DFA61FE ft=1 fh=952c31605346c5cf vn="Variante von MSIL/BrowseFox.G evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\WebConnect\bin\plugins\WebConnect.Bromon.dll.vir"
sh=9191F6DD330F4D09EDBC9BDA8CC17550BA1151C4 ft=1 fh=261f6326e52ebaaa vn="Variante von MSIL/BrowseFox.G evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\WebConnect\bin\plugins\WebConnect.BroStats.dll.vir"
sh=AD73A3732D220A6D7AD3537878A0B99118850BFF ft=1 fh=56312ddc7cbdd809 vn="möglicherweise Variante von MSIL/BrowseFox.G evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\WebConnect\bin\plugins\WebConnect.BrowserAdapter.dll.vir"
sh=E16B35E0B1878A78F3351CCFC6139C65F36B14E3 ft=1 fh=90424eae06e080ca vn="möglicherweise Variante von MSIL/BrowseFox.G evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\WebConnect\bin\plugins\WebConnect.BrowserAdapterS.dll.vir"
sh=0A6A9D28F4D09F6BE17E3DE97B729E23555D592F ft=1 fh=d76203847a37b1a0 vn="Variante von MSIL/BrowseFox.G evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\WebConnect\bin\plugins\WebConnect.CompatibilityChecker.dll.vir"
sh=229337A0431405DF05087BAD70476DBD5BCB1621 ft=1 fh=d407c95dc2e3a652 vn="Variante von MSIL/BrowseFox.G evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\WebConnect\bin\plugins\WebConnect.FFUpdate.dll.vir"
sh=2E5CB7A5CDBDDDC63D27C3B77CD469330033EDA3 ft=1 fh=a7df8d9a2688f4f6 vn="Variante von MSIL/BrowseFox.E evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\WebConnect\bin\plugins\WebConnect.GCUpdate.dll.vir"
sh=15AE5D4F9677A65BA61C6FF0EF16B30DF9262C87 ft=1 fh=5d8aab8842c6c9d2 vn="Variante von MSIL/BrowseFox.G evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\WebConnect\bin\plugins\WebConnect.IEUpdate.dll.vir"
sh=0BC93A700932D17C3C4FAE1D263B00D9A5F8715C ft=1 fh=67ce13d9d9ad48aa vn="Variante von MSIL/BrowseFox.G evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\WebConnect\bin\plugins\WebConnect.OfSvc.dll.vir"
sh=9F10510B94D22EC71EF41F8EDDEAE2D3225CC519 ft=1 fh=31dd6c8459df4d05 vn="Variante von MSIL/BrowseFox.G evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\WebConnect\bin\plugins\WebConnect.PurBrowse.dll.vir"
sh=389D5D5773B5B681544A69A46A0F2FCFEE7D79C3 ft=1 fh=83e6c985f2751192 vn="Variante von MSIL/BrowseFox.G evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\WebConnect\bin\plugins\WebConnect.Repmon.dll.vir"
sh=269A3368502E65D5240B427B3598BCCE6DD2FB88 ft=1 fh=1ba54bdd7addd712 vn="Variante von Win32/BrowseFox.G evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\WebConnect\update\d2qcyoul.1hw.exe.vir"

SecurityCheck:

Code:

ATTFilter

 Results of screen317's Security Check version 0.99.85  
 Windows 7 Service Pack 1 x64 (UAC is enabled)  
 Internet Explorer 11  
``````````````Antivirus/Firewall Check:`````````````` 
Avira Desktop   
 Antivirus up to date!   
`````````Anti-malware/Other Utilities Check:````````` 
 Adobe Flash Player 10 Flash Player out of Date! 
 Adobe Reader 10.1.10 Adobe Reader out of Date!  
````````Process Check: objlist.exe by Laurent````````  
 Malwarebytes Anti-Malware mbam.exe  
 Avira Antivir avgnt.exe 
 Avira Antivir avguard.exe 
 Malwarebytes Anti-Malware mbamscheduler.exe   
`````````````````System Health check````````````````` 
 Total Fragmentation on Drive C:  
````````````````````End of Log``````````````````````

FRST:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 26-07-2014
Ran by Heinz (administrator) on HEINZ-PC on 29-07-2014 22:53:50
Running from C:\Users\Heinz\Documents\TBoard
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal



==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(ASUSTeK Computer Inc.) C:\Windows\System32\FBAgent.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\AsLdrSrv.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(ASUS) C:\Program Files (x86)\ASUS\InstantOn for NB\InsOnSrv.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe
(McAfee, Inc.) C:\Windows\System32\mfevtps.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(McAfee, Inc.) C:\Program Files\Common Files\mcafee\systemcore\mcshield.exe
(McAfee, Inc.) C:\Program Files\Common Files\mcafee\systemcore\mfefire.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe
(ASUS) C:\Program Files (x86)\ASUS\InstantOn for NB\InsOnWMI.exe
(ASUS) C:\Program Files\ASUS\P4G\BatteryLife.exe
(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\FaceLogon\sensorsrv.exe
(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe
(ASUS) C:\Program Files (x86)\ASUS\Splendid\ACMON.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ATKOSD.exe
(ASUSTeK) C:\Windows\SysWOW64\ACEngSvr.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\KBFiltr.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\WDC.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Alcor Micro Corp.) C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Virage Logic Corporation / Sonic Focus) C:\Program Files (x86)\ASUS\Sonic Focus\SonicFocusTray.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe
(ASUS) C:\Windows\AsScrPro.exe
(Microsoft Corporation) C:\Program Files (x86)\Common Files\microsoft shared\Virtualization Handler\CVHSVC.EXE
(ASUS) C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe
(CyberLink) C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avwebgrd.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Adobe Systems Incorporated) C:\Windows\System32\Macromed\Flash\FlashUtil64_14_0_0_145_ActiveX.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2785064 2011-05-05] (Synaptics Incorporated)
HKLM\...\Run: [AmIcoSinglun64] => C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe [361984 2011-03-21] (Alcor Micro Corp.)
HKLM\...\Run: [SynAsusAcpi] => C:\Program Files\Synaptics\SynTP\SynAsusAcpi.exe [97064 2011-05-05] (Synaptics Incorporated)
HKLM\...\Run: [RtHDVBg] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [2277480 2011-08-16] (Realtek Semiconductor)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [ASUSPRP] => C:\Program Files (x86)\ASUS\APRP\APRP.EXE [3331312 2012-02-24] (ASUSTek Computer Inc.)
HKLM-x32\...\Run: [ASUSWebStorage] => C:\Program Files (x86)\ASUS\ASUS WebStorage\3.0.108.222\AsusWSPanel.exe [737104 2011-07-29] (ecareme)
HKLM-x32\...\Run: [SonicMasterTray] => C:\Program Files (x86)\ASUS\Sonic Focus\SonicFocusTray.exe [984400 2010-07-10] (Virage Logic Corporation / Sonic Focus)
HKLM-x32\...\Run: [ATKOSD2] => C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe [318080 2011-12-23] (ASUSTek Computer Inc.)
HKLM-x32\...\Run: [ATKMEDIA] => C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe [174720 2011-10-25] (ASUS)
HKLM-x32\...\Run: [HControlUser] => C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe [105016 2009-06-19] (ASUS)
HKLM-x32\...\Run: [Wireless Console 3] => C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe [2319536 2011-10-19] (ASUS)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [750160 2014-07-05] (Avira Operations GmbH & Co. KG)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\AsusVibeLauncher.lnk
ShortcutTarget: AsusVibeLauncher.lnk -> C:\Program Files (x86)\ASUS\AsusVibe\AsusVibeLauncher.exe (ASUSTeK Computer Inc.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\FancyStart daemon.lnk
ShortcutTarget: FancyStart daemon.lnk -> C:\Windows\Installer\{C944B4C5-1C4D-4D95-8AC0-7CEF13914131}\_77B5857C27147149171BE7.exe ()
ShellIconOverlayIdentifiers: AsusWSShellExt_B -> {6D4133E5-0742-4ADC-8A8C-9303440F7190} => C:\Program Files (x86)\ASUS\ASUS WebStorage\3.0.108.222\ASUSWSShellExt64.dll (eCareme Technologies, Inc.)
ShellIconOverlayIdentifiers: AsusWSShellExt_O -> {64174815-8D98-4CE6-8646-4C039977D808} => C:\Program Files (x86)\ASUS\ASUS WebStorage\3.0.108.222\ASUSWSShellExt64.dll (eCareme Technologies, Inc.)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://rts.dsrlte.com
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKCU - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKCU - {24504368-4233-4638-BB3C-92EC547C805F} URL = hxxp://de.search.yahoo.com/search?fr=mcafee&p={SearchTerms}
SearchScopes: HKCU - {326305B4-41F1-48D5-ADBF-BBAAFE0C6EF9} URL = hxxp://rts.dsrlte.com/?q={searchTerms}&r=97
BHO: scriptproxy -> {7DB2D5A0-7241-4E79-B68D-6309F01C5231} -> C:\Program Files\Common Files\McAfee\SystemCore\ScriptSn.20120806173924.dll (McAfee, Inc.)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: scriptproxy -> {7DB2D5A0-7241-4E79-B68D-6309F01C5231} -> C:\Program Files (x86)\Common Files\McAfee\SystemCore\ScriptSn.20120806173924.dll (McAfee, Inc.)
BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

FireFox:
========
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF32.dll No File
FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3538.0513 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF HKLM-x32\...\Firefox\Extensions: [{D19CA586-DD6C-4a0a-96F8-14644F340D60}] - C:\Program Files (x86)\Common Files\McAfee\SystemCore
FF Extension: No Name - C:\Program Files (x86)\Common Files\McAfee\SystemCore [2012-02-24]

Chrome: 
=======
Error reading preferences. Please check "preferences" file for possible corruption. <======= ATTENTION

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S2 AntiVirMailService; C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc.exe [801872 2014-07-05] (Avira Operations GmbH & Co. KG)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [430160 2014-07-05] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [430160 2014-07-05] (Avira Operations GmbH & Co. KG)
R2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [1028688 2014-07-05] (Avira Operations GmbH & Co. KG)
R2 ASUS InstantOn; C:\Program Files (x86)\ASUS\InstantOn for NB\InsOnSrv.exe [277120 2012-02-17] (ASUS)
R2 MBAMScheduler; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe [1809720 2014-05-12] (Malwarebytes Corporation)
S2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [860472 2014-05-12] (Malwarebytes Corporation)
R2 McShield; C:\Program Files\Common Files\McAfee\SystemCore\\mcshield.exe [199304 2012-05-25] (McAfee, Inc.)
R2 mfefire; C:\Program Files\Common Files\McAfee\SystemCore\\mfefire.exe [210616 2012-05-25] (McAfee, Inc.)
R2 mfevtp; C:\Windows\system32\mfevtps.exe [162224 2012-05-25] (McAfee, Inc.)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [117712 2014-07-05] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [130584 2014-06-23] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-12-08] (Avira Operations GmbH & Co. KG)
S3 cfwids; C:\Windows\System32\drivers\cfwids.sys [65264 2012-02-22] (McAfee, Inc.)
R3 kbfiltr; C:\Windows\System32\DRIVERS\kbfiltr.sys [15416 2009-07-20] ( )
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-05-12] (Malwarebytes Corporation)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [122584 2014-07-29] (Malwarebytes Corporation)
S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2014-05-12] (Malwarebytes Corporation)
R3 mfeapfk; C:\Windows\System32\drivers\mfeapfk.sys [160792 2012-02-22] (McAfee, Inc.)
R3 mfeavfk; C:\Windows\System32\drivers\mfeavfk.sys [229528 2012-02-22] (McAfee, Inc.)
R3 mfefirek; C:\Windows\System32\drivers\mfefirek.sys [487296 2012-02-22] (McAfee, Inc.)
R0 mfehidk; C:\Windows\System32\drivers\mfehidk.sys [647208 2012-02-22] (McAfee, Inc.)
R1 mfenlfk; C:\Windows\System32\DRIVERS\mfenlfk.sys [75936 2012-02-22] (McAfee, Inc.)
S3 mferkdet; C:\Windows\System32\drivers\mferkdet.sys [100912 2012-02-22] (McAfee, Inc.)
R0 mfewfpk; C:\Windows\System32\drivers\mfewfpk.sys [289664 2012-02-22] (McAfee, Inc.)
S3 catchme; \??\C:\ComboFix\catchme.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-07-29 19:50 - 2014-07-29 19:50 - 00000000 ____D () C:\Program Files (x86)\ESET
2014-07-29 12:55 - 2014-07-29 12:55 - 01016261 _____ (Thisisu) C:\Users\Heinz\Downloads\JRT.exe
2014-07-29 12:55 - 2014-07-29 12:55 - 00000000 ____D () C:\Windows\ERUNT
2014-07-29 12:48 - 2010-08-30 08:34 - 00536576 _____ (SQLite Development Team) C:\Windows\SysWOW64\sqlite3.dll
2014-07-29 12:47 - 2014-07-29 12:49 - 00000000 ____D () C:\AdwCleaner
2014-07-29 12:46 - 2014-07-29 12:46 - 01365525 _____ () C:\Users\Heinz\Downloads\adwcleaner_3.301.exe
2014-07-28 19:13 - 2014-07-28 19:13 - 00012948 _____ () C:\ComboFix.txt
2014-07-28 17:39 - 2011-06-26 08:45 - 00256000 _____ () C:\Windows\PEV.exe
2014-07-28 17:39 - 2010-11-07 19:20 - 00208896 _____ () C:\Windows\MBR.exe
2014-07-28 17:39 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2014-07-28 17:39 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2014-07-28 17:39 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2014-07-28 17:39 - 2000-08-31 02:00 - 00098816 _____ () C:\Windows\sed.exe
2014-07-28 17:39 - 2000-08-31 02:00 - 00080412 _____ () C:\Windows\grep.exe
2014-07-28 17:39 - 2000-08-31 02:00 - 00068096 _____ () C:\Windows\zip.exe
2014-07-28 17:38 - 2014-07-28 19:13 - 00000000 ____D () C:\Qoobox
2014-07-28 17:38 - 2014-07-28 19:01 - 00000000 ____D () C:\Windows\erdnt
2014-07-28 17:24 - 2014-07-28 17:24 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group
2014-07-28 17:23 - 2014-07-28 17:24 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Heinz\Downloads\revosetup95.exe
2014-07-27 23:39 - 2014-07-29 22:53 - 00000000 ____D () C:\FRST
2014-07-27 23:38 - 2014-07-27 23:38 - 00000000 _____ () C:\Users\Heinz\defogger_reenable
2014-07-27 19:11 - 2014-07-27 19:11 - 00072096 _____ () C:\Users\Heinz\AVSCAN-20140727-181902-181264F8.LOG
2014-07-27 18:27 - 2014-07-29 22:53 - 00000000 ____D () C:\Users\Heinz\Documents\TBoard
2014-07-27 18:18 - 2014-07-27 18:18 - 00003532 _____ () C:\Windows\System32\Tasks\Yahoo! Search
2014-07-14 15:20 - 2014-06-20 22:14 - 00266424 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-07-14 15:20 - 2014-06-20 21:39 - 00240824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2014-07-14 15:20 - 2014-06-19 03:39 - 23464448 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-07-14 15:20 - 2014-06-19 03:06 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-07-14 15:20 - 2014-06-19 03:06 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-07-14 15:20 - 2014-06-19 02:48 - 02768384 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-07-14 15:20 - 2014-06-19 02:42 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-07-14 15:20 - 2014-06-19 02:42 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-07-14 15:20 - 2014-06-19 02:41 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2014-07-14 15:20 - 2014-06-19 02:41 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-07-14 15:20 - 2014-06-19 02:32 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-07-14 15:20 - 2014-06-19 02:31 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-07-14 15:20 - 2014-06-19 02:26 - 00598016 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-07-14 15:20 - 2014-06-19 02:24 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-07-14 15:20 - 2014-06-19 02:24 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-07-14 15:20 - 2014-06-19 02:23 - 00752640 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-07-14 15:20 - 2014-06-19 02:16 - 17276416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-07-14 15:20 - 2014-06-19 02:14 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-07-14 15:20 - 2014-06-19 02:09 - 00452608 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-07-14 15:20 - 2014-06-19 01:59 - 00038400 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-07-14 15:20 - 2014-06-19 01:56 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-07-14 15:20 - 2014-06-19 01:53 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-07-14 15:20 - 2014-06-19 01:51 - 05721088 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-07-14 15:20 - 2014-06-19 01:50 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-07-14 15:20 - 2014-06-19 01:48 - 00292864 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-07-14 15:20 - 2014-06-19 01:39 - 00608768 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-07-14 15:20 - 2014-06-19 01:38 - 00455168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-07-14 15:20 - 2014-06-19 01:37 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-07-14 15:20 - 2014-06-19 01:36 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-07-14 15:20 - 2014-06-19 01:35 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2014-07-14 15:20 - 2014-06-19 01:33 - 00631808 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-07-14 15:20 - 2014-06-19 01:32 - 02179072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-07-14 15:20 - 2014-06-19 01:28 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-07-14 15:20 - 2014-06-19 01:28 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-07-14 15:20 - 2014-06-19 01:27 - 02040832 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-07-14 15:20 - 2014-06-19 01:27 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-07-14 15:20 - 2014-06-19 01:25 - 00442368 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-07-14 15:20 - 2014-06-19 01:23 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-07-14 15:20 - 2014-06-19 01:22 - 00592896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-07-14 15:20 - 2014-06-19 01:12 - 00367616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-07-14 15:20 - 2014-06-19 01:06 - 00032256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-07-14 15:20 - 2014-06-19 01:01 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-07-14 15:20 - 2014-06-19 00:59 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-07-14 15:20 - 2014-06-19 00:58 - 02266112 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-07-14 15:20 - 2014-06-19 00:58 - 00239616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-07-14 15:20 - 2014-06-19 00:52 - 04254720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-07-14 15:20 - 2014-06-19 00:51 - 13527040 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-07-14 15:20 - 2014-06-19 00:49 - 00526336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-07-14 15:20 - 2014-06-19 00:46 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2014-07-14 15:20 - 2014-06-19 00:45 - 01964544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-07-14 15:20 - 2014-06-19 00:35 - 11742208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-07-14 15:20 - 2014-06-19 00:34 - 01393664 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-07-14 15:20 - 2014-06-19 00:15 - 00846336 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-07-14 15:20 - 2014-06-19 00:13 - 01791488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-07-14 15:20 - 2014-06-19 00:09 - 01139200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-07-14 15:20 - 2014-06-19 00:07 - 00704512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-07-14 15:19 - 2014-06-30 04:09 - 00519168 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-07-14 15:19 - 2014-06-30 04:04 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-07-14 15:19 - 2014-06-18 04:18 - 00692736 _____ (Microsoft Corporation) C:\Windows\system32\osk.exe
2014-07-14 15:19 - 2014-06-18 03:51 - 00646144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\osk.exe
2014-07-14 15:19 - 2014-06-18 03:10 - 03157504 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-07-14 15:19 - 2014-06-06 12:10 - 00624128 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll
2014-07-14 15:19 - 2014-06-06 11:44 - 00509440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll
2014-07-14 15:19 - 2014-05-30 10:08 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2014-07-14 15:19 - 2014-05-30 10:08 - 00340992 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2014-07-14 15:19 - 2014-05-30 10:08 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2014-07-14 15:19 - 2014-05-30 10:08 - 00307200 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2014-07-14 15:19 - 2014-05-30 10:08 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2014-07-14 15:19 - 2014-05-30 10:08 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2014-07-14 15:19 - 2014-05-30 10:08 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2014-07-14 15:19 - 2014-05-30 09:52 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2014-07-14 15:19 - 2014-05-30 09:52 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2014-07-14 15:19 - 2014-05-30 09:52 - 00247808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2014-07-14 15:19 - 2014-05-30 09:52 - 00220160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2014-07-14 15:19 - 2014-05-30 09:52 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2014-07-14 15:19 - 2014-05-30 09:52 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2014-07-14 15:19 - 2014-05-30 09:52 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2014-07-14 15:19 - 2014-05-30 08:45 - 00497152 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys
2014-07-14 15:15 - 2014-06-05 16:45 - 01460736 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2014-07-14 15:15 - 2014-06-05 16:26 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2014-07-14 15:15 - 2014-06-05 16:25 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2014-07-05 16:43 - 2014-07-05 16:43 - 00000000 ____D () C:\Users\Heinz\AppData\Local\Adobe

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-07-29 22:53 - 2014-07-27 23:39 - 00000000 ____D () C:\FRST
2014-07-29 22:53 - 2014-07-27 18:27 - 00000000 ____D () C:\Users\Heinz\Documents\TBoard
2014-07-29 22:35 - 2013-03-31 15:17 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-07-29 22:35 - 2012-07-30 17:34 - 00000387 _____ () C:\Users\Heinz\AppData\Roaming\sp_data.sys
2014-07-29 21:31 - 2012-05-22 14:35 - 01136877 _____ () C:\Windows\WindowsUpdate.log
2014-07-29 20:03 - 2014-06-08 17:41 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-07-29 19:54 - 2009-07-14 06:45 - 00009696 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-07-29 19:54 - 2009-07-14 06:45 - 00009696 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-07-29 19:50 - 2014-07-29 19:50 - 00000000 ____D () C:\Program Files (x86)\ESET
2014-07-29 19:48 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\NDF
2014-07-29 19:46 - 2012-07-30 17:35 - 00000000 ___HD () C:\ASUS.DAT
2014-07-29 19:45 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-07-29 19:45 - 2009-07-14 06:51 - 00065989 _____ () C:\Windows\setupact.log
2014-07-29 12:55 - 2014-07-29 12:55 - 01016261 _____ (Thisisu) C:\Users\Heinz\Downloads\JRT.exe
2014-07-29 12:55 - 2014-07-29 12:55 - 00000000 ____D () C:\Windows\ERUNT
2014-07-29 12:50 - 2012-02-24 03:34 - 00171576 _____ () C:\Windows\PFRO.log
2014-07-29 12:49 - 2014-07-29 12:47 - 00000000 ____D () C:\AdwCleaner
2014-07-29 12:46 - 2014-07-29 12:46 - 01365525 _____ () C:\Users\Heinz\Downloads\adwcleaner_3.301.exe
2014-07-28 19:13 - 2014-07-28 19:13 - 00012948 _____ () C:\ComboFix.txt
2014-07-28 19:13 - 2014-07-28 17:38 - 00000000 ____D () C:\Qoobox
2014-07-28 19:12 - 2009-07-14 04:34 - 00000215 _____ () C:\Windows\system.ini
2014-07-28 19:03 - 2009-07-14 05:20 - 00000000 __RHD () C:\Users\Default
2014-07-28 19:01 - 2014-07-28 17:38 - 00000000 ____D () C:\Windows\erdnt
2014-07-28 17:24 - 2014-07-28 17:24 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group
2014-07-28 17:24 - 2014-07-28 17:23 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Heinz\Downloads\revosetup95.exe
2014-07-27 23:38 - 2014-07-27 23:38 - 00000000 _____ () C:\Users\Heinz\defogger_reenable
2014-07-27 23:38 - 2012-07-30 17:34 - 00000000 ____D () C:\Users\Heinz
2014-07-27 19:22 - 2012-08-26 17:32 - 00000000 ____D () C:\Heinz
2014-07-27 19:11 - 2014-07-27 19:11 - 00072096 _____ () C:\Users\Heinz\AVSCAN-20140727-181902-181264F8.LOG
2014-07-27 18:50 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\Resources
2014-07-27 18:22 - 2009-07-14 04:34 - 00000537 _____ () C:\Windows\win.ini
2014-07-27 18:18 - 2014-07-27 18:18 - 00003532 _____ () C:\Windows\System32\Tasks\Yahoo! Search
2014-07-27 17:26 - 2009-07-29 07:20 - 00000000 ____D () C:\Windows\ABLKSR
2014-07-26 16:03 - 2013-03-19 13:51 - 00000000 ____D () C:\Program Files\Microsoft Silverlight
2014-07-26 16:03 - 2013-03-19 13:51 - 00000000 ____D () C:\Program Files (x86)\Microsoft Silverlight
2014-07-26 16:03 - 2009-07-14 07:08 - 00032632 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-07-25 17:28 - 2013-03-19 13:52 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
2014-07-24 15:33 - 2011-02-19 06:24 - 00700118 _____ () C:\Windows\system32\perfh007.dat
2014-07-24 15:33 - 2011-02-19 06:24 - 00149968 _____ () C:\Windows\system32\perfc007.dat
2014-07-24 15:33 - 2009-07-14 07:13 - 01622164 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-07-24 15:29 - 2013-05-09 16:36 - 00042040 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2014-07-24 15:26 - 2009-07-14 06:45 - 00294712 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-07-24 15:23 - 2014-05-12 14:54 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-07-24 15:23 - 2009-07-14 09:45 - 00000000 ____D () C:\Program Files\Windows Journal
2014-07-24 15:23 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\SysWOW64\Dism
2014-07-24 15:23 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\Dism
2014-07-14 15:44 - 2013-08-20 17:05 - 00000000 ____D () C:\Windows\system32\MRT
2014-07-14 15:42 - 2012-08-26 16:43 - 96441528 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-07-10 16:29 - 2013-03-31 15:17 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-07-10 16:29 - 2013-03-31 15:16 - 00699056 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-07-10 16:29 - 2013-03-31 15:16 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-07-07 12:01 - 2009-07-14 07:09 - 00000000 ____D () C:\Windows\System32\Tasks\WPD
2014-07-05 16:43 - 2014-07-05 16:43 - 00000000 ____D () C:\Users\Heinz\AppData\Local\Adobe
2014-07-05 16:12 - 2013-04-15 14:42 - 00117712 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2014-06-30 04:09 - 2014-07-14 15:19 - 00519168 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-06-30 04:04 - 2014-07-14 15:19 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll

Some content of TEMP:
====================
C:\Users\Heinz\AppData\Local\Temp\avgnt.exe
C:\Users\Heinz\AppData\Local\Temp\Quarantine.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2013-08-26 15:37

==================== End Of Log ============================

--- --- ---

schrauber · 30.07.2014, 14:23

Sind alle schon in Quarantäne

Java und Flash updaten.

Fertig

Die Reihenfolge ist hier entscheidend.

Falls Defogger benutzt wurde: Defogger nochmal starten und auf re-enable klicken.
Falls Combofix benutzt wurde: (Alternativ in uninstall.exe umbenennen und starten)
- Windowstaste + R > Combofix /Uninstall (eingeben) > OK
- Alternative: Combofix.exe in uninstall.exe umbenennen und starten
- Combofix wird jetzt starten, sich evtl updaten und dann alle Reste von sich selbst entfernen.
Downloade Dir bitte auf jeden Fall DelFix auf deinen Desktop:
- Schließe alle offenen Programme.
- Starte die delfix.exe mit einem Doppelklick.
- Setze vor jede Funktion ein Häkchen.
- Klicke auf Start.
- Hinweis: DelFix entfernt u. a. alle verwendeten Programme, die Quarantäne unserer Scanner, den Java-Cache und löscht sich abschließend selbst.
- Starte deinen Rechner abschließend neu.
Sollten jetzt noch Programme aus unserer Bereinigung übrig sein kannst du sie bedenkenlos löschen.

Falls Du Lob oder Kritik abgeben möchtest kannst Du das hier tun

Hier noch ein paar Tipps zur Absicherung deines Systems.

Ich kann garnicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.

Bitte überprüfe ob dein System Windows Updates automatisch herunter lädt
Windows Updates
- Windows XP: Start --> Systemsteuerung --> Doppelklick auf Automatische Updates
- Windows Vista / 7: Start --> Systemsteuerung --> System und Sicherheit --> Automatische Updates aktivieren oder deaktivieren
Gehe sicher das die automatischen Updates aktiviert sind.
Software Updates
Installierte Software kann ebenfalls Sicherheitslücken haben, welche Malware nutzen kann, um dein System zu infizieren.
Um deine Installierte Software up to date zu halten, empfehle ich dir Secunia Online Software.

Anti- Viren Software

Gehe sicher immer eine Anti Viren Software installiert zu haben und das diese auch up to date ist. Es ist nämlich nutzlos wenn diese out of date sind.

Zusätzlicher Schutz

MalwareBytes Anti Malware
Dies ist eines der besten Anti-Malware Tools auf dem Markt. Es ist ein On- Demond Scan Tool welches viele aktuelle Malware erkennt und auch entfernt.
Update das Tool und lass es einmal in der Woche laufen. Die Kaufversion biete zudem noch einen Hintergrundwächter.
Ein Tutorial zur Verwendung findest Du hier.
WinPatrol
Diese Software macht einen Snapshot deines Systems und warnt dich vor eventuellen Änderungen. Downloade dir die Freeware Version von hier.

Sicheres Browsen

SpywareBlaster
Eine kurze Einführung findest du Hier
MVPs hosts file
Ein Tutorial findest Du hier. Leider habe ich bis jetzt kein deutschsprachiges gefunden.
WOT (Web of trust)
Dieses AddOn warnt Dich bevor Du eine als schädlich gemeldete Seite besuchst.

Alternative Browser

Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.

Opera
Mozilla Firefox.
- Hinweis: Für diesen Browser habe ich hier ein paar nützliche Add Ons
- NoScript
  Dieses AddOn blockt JavaScript, Java and Flash und andere Plugins. Sie werden nur dann ausgeführt wenn Du es bestätigst.
- AdblockPlus
  Dieses AddOn blockt die meisten Werbung von selbst. Ein Rechtsklick auf den Banner um diesen zu AdBlockPlus hinzu zu fügen reicht und dieser wird nicht mehr geladen.
  Es spart ausserdem Downloadkapazität.

Performance
Bereinige regelmäßig deine Temp Files. Ich empfehle hierzu TFC
Halte dich fern von jedlichen Registry Cleanern.
Diese Schaden deinem System mehr als sie helfen. Hier ein paar ( englishe ) Links
Miekemoes Blogspot ( MVP )
Bill Castner ( MVP )

Don'ts

Klicke nicht auf alles nur weil es Dich dazu auffordert und schön bunt ist.
verwende keine peer to peer oder Filesharing Software (Emule, uTorrent,..)
Lass die Finger von Cracks, Keygens, Serials oder anderer illegaler Software.
Öffne keine Anhänge von Dir nicht bekannten Emails. Achte vor allem auf die Dateiendung wie zb deinFoto.jpg.exe

Nun bleibt mir nur noch dir viel Spass beim sicheren Surfen zu wünschen.

Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so das ich diesen Thread aus meinen Abos löschen kann.

Fonix · 30.07.2014, 20:03

Vielen Dank für die ganzen Tipps/Hinweise und ein großes Dankeschön dafür, dass Sie mir geholfen haben den Laptop zu bereinigen. Das Problem ist halt auch das, dass mein Opa nicht so viel von Laptops/PC's versteht und ihn auch nur für E-Mails und Briefe verfassen benutzt. So etwas zu erklären, wie z.B. Updates oder so durchzuführen ist auch schwer und selbst dann schafft er es wahrscheinlich leider nicht alleine.

Thread kann dann geschlossen werden.

schrauber · 31.07.2014, 19:55

Gern Geschehen

31.07.2014, 19:55	#10
schrauber /// the machine /// TB-Ausbilder	Malwarebytes mehrere Funde, auch Trojaner? Gern Geschehen __________________ gruß, schrauber *Proud Member of UNITE and ASAP since 2009* Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM!

Malwarebytes mehrere Funde, auch Trojaner?

Plagegeister aller Art und deren Bekämpfung: Malwarebytes mehrere Funde, auch Trojaner?